Re: [Doh] WGLC #2

[Patrick McManus <[e-mail]>]

On Tue, May 22, 2018 at 11:37 AM, Sara Dickinson <[e-mail]> wrote:

>
> 1) I previously asked if this spec required that a DNS API Sever should
> only be used if authentication of the TLS connection was successful. I got
> conflicting answers from Paul and Martin (‘No we can’t say that’ vs
> ‘authentication is critical and implicit’) and don’t see anything in this
> version that resolves this. I know there is other work attempting to
> address this issue (and more) but the lack of clarity in this document on
> the topic is still an issue for me. I’d still like to see a single sentence
> that either
> - makes clear the requirement (preferable) or
> - states that this is out of scope
>
>
Martin is right - I'm not sure where the confusion originated.
Authentication is part of HTTPS. I know dprive went down the road of
opportunistic security, but that's not something HTTPS does. (plaintext
http:// might, but we're pretty clear about doh steering clear of that.)

https://github.com/dohwg/draft-ietf-doh-dns-over-https/pull/186

does this work?

 -DNS API client MUST only use a DNS API server that is configured as
trustworthy.
+DNS API client MUST only use a DNS API server that is configured as
+trustworthy. {{RFC2818}} defines how HTTPS verifies the identity of
+a connection with the trusted service.