Re: [dnsoverhttp] New draft: draft-hoffman-dns-over-http-00.txt

[Ted Hardie <[e-mail]>]

On Wed, Sep 21, 2016 at 6:24 PM, Martin Thomson <[e-mail]>
wrote:

> On 22 September 2016 at 03:21, Ted Hardie <[e-mail]> wrote:
> > You'll get a different answer if you make another request using a
> different
> > method or DNS API server.
>
> Well, you might assume that the last response is the best, otherwise
> we're into the whole "man with two clocks" paradigm of protocol
> engineering.


Sorry, I apparently wasn't clear.  The point I was making was in response
to your statement in this part of the thread:

Ted: That can't be corrected by DNSSEC, since it is correctly signed.
>
> Martin: It can be corrected by making another request.
>
> I was trying to point that in order to test this using your method you
have to have access to a different DNS API server or a different protocol
with the same security properties (e.g. DNS over TLS or DNS over DTLS).

Using either of those test methods is also going to be bad for latency, so
it is not going to happen in the common case, unless we explicitly scope
things so that it does.  You could imagine, for example, a server marking
an answer as reusable and the client testing those before moving them from
a context-specific cache to a general cache.

I think the safest thing to do is to treat all of these answers as
explicitly scoped to the context in which they were received, but that's
actually a big change to the consistency model.  It's also not really
fixable with the usual DNS TTL tricks, because the action required is "ask
a different server" not "ask again".  Re-asking the same server at TTL
expiration doesn't improve the security properties at all.

Hope that is clearer,

Ted