Re: [Doh] Mozilla's plans re: DoH

[Brian Dickson <[e-mail]>]

On Wed, Mar 27, 2019 at 2:18 AM Eric Rescorla <[e-mail]> wrote:

> I’ve heard a number of questions about Mozilla’s plans around
> DoH. We’ve made a number of public statements, but it might be useful
> to try to put this all in one place.
>
> In context, the problem we are attempting to solve here is attack on
> the user’s name resolution from an attacker with full or partial
> control of the network, as contemplated by Section 3 of BCP 72 as well
> as BCP 188. There’s ample evidence of monitoring/manipulation of user
> traffic via this vector [0][1][2].
>

> [1]
> https://www.usenix.org/system/files/conference/usenixsecurity17/sec17-pearce.pdf
>

Looking specifically at the problem statement and evidence, I have a
question about this (or any other) investigative work:
Has there been any related/follow-up work, or other similarly scoped work,
to examine the use of DNSSEC in the domains tested, that you're aware of or
can point folks at?

I.e. Were any of the manipulated domains signed DNSSEC domains, where
validation might have prevented the manipulated responses from being
accepted from the resolver?

Clearly there would still be the issue of being able to find/reach a
resolver that does not manipulate results, but at least the manipulation
would be detected/blocked.

(Percentages overall, and percentages in the manipulated results groups,
would both be interesting and informative.)

Brian