Re: [Doh] draft-ietf-doh-resolver-associated-doh-02 comments

["Martin Thomson" <[e-mail]>]

On Wed, Mar 20, 2019, at 07:53, Stephen Farrell wrote:
> - Section 2: what about OCSP? are we assuming that the OCSP
> responder is resolved by the precursor system resolver or
> the DoH resolver or both? I don't think it makes a security
> difference (OCSP works or doesn't as usual), but it may be
> a gotcha in terms of establishing the TLS session. Or, are
> we assuming there's no point in OCSP for an IP-address
> cert? (I forget;-)

In capport we've made some recommendations about what can be done when you have limited network access.  The situation isn't identical, but the guidance is the same: staple OCSP responses and provide all intermediates (i.e., don't send people chasing after AIA URLs that they can't resolve).
 
> - Section 2: "the normal rules for HTTP" - does that mean
> all re-directs MUST be HTTPS too? And can those URLs use
> DNS names or must they be IP address certs too?

There are no "normal rules" for HTTP and redirects.  You have to explicitly say that redirects to unauthenticated resources are not permitted.

> - Section 7, para 1: that's way too one-sided. DoH could
> be less privacy-friendly (than say DoT) due to cookies and
> whatnot.

I think that it might pay to spend some time on this particular meme on a separate thread.  My view is that while the opportunities exist, a lot of the concern here comes more from this being different and new and less from real provable problems.  For instance, both parties have to work pretty hard to get cookies.  Even in the contexts where you think that you might not have to (like a browser).
 
> - Section 8: Why diss. DoT? It's not a competition:-)

I agree.  It is, but it's our responsibility to rise above that.