Re: [Doh] Authentication in draft-ietf-doh-resolver-associated-doh-03.txt

[Erik Nygren <[e-mail]>]

On Tue, Mar 26, 2019 at 6:26 AM Patrick McManus <[e-mail]>
wrote:

>
> right. The weakness here is that validating a name that probably comes
> from an unauthenticated source is not a very strong signal. That seems
> inherent in the draft, but maybe worth calling out more explicitly.
>

Right.  It typically comes from unauthenticated DHCP or RDNSS.

One thought I've pondered is whether there is a way to apply policy to the
hostname in the DoH template URL, as that is an authenticated hostname.
For example, clients could validate against a blacklist of known-bad DoH
server hostnames/domains.  This may not scale well enough to be viable.
But we are inherently getting unauthenticated data from an unauthenticated
source.  But that unauthenticated data is something which is possible to
authenticate and possibly authorize based on the hostname.

A similar model is done in Provisioning Domains where unauthenticated PvDs
come from the network and are used to construct well-known URLs:
https://tools.ietf.org/html/draft-ietf-intarea-provisioning-domains-04

How to make this practical is where I get stuck.  :-)

       Erik