[Doh] TSIG, Padding and "Age:"

["Mark Delany" <[e-mail]>]

Sorry. More hand-wringing.

Section 9 of RFC8484 (DoH) says "servers can also add DNS padding [RFC7830] if
the DoH client requests it in the DNS query".

However section 3.4 of RFC2845 (TSIG) says that essentially the whole message is
protected by the hash calculation (bar a few irrelevant odds and sods) which
means that a DoH server adding padding will break the TSIG message digest.

Therefore is it correct to say that a DoH server cannot add padding if the DNS
message contains a TSIG RR?

I see no mention of this constraint in either RFC8484 or RFC7830 so it might be
easy to miss unless you dig deep. If my reading is correct, would a proviso in
Section 9 be helpful for implementors?


If TSIG is in play - and I don't really know until someone here confirms it -
does the TSIG constraint on message modification also conflict with Section 5.1
of RFC8484 which states: "DoH clients MUST account for the Age response header
field's value" ... and modify TTLs?

Would that section similarly benefit from the proviso of "MUST account for the
Age ... unless TSIG is present" or perhaps more generally "no modifications if
the message is cryptographically protected"? Dunno how you do that with
unknowable future crptographic protections, but oh well.


I tell ya. Once you step into the waters of modifying in-flight DNS messages it
seems like crocodiles all the way down.


Mark.