[Doh] Resolver-associated comments (mike follow-up)

Brian Dickson <brian.peter.dickson@gmail.com> Tue, 26 March 2019 13:47 UTC

Return-Path: <brian.peter.dickson@gmail.com>
X-Original-To: doh@ietfa.amsl.com
Delivered-To: doh@ietfa.amsl.com
Received: from localhost (localhost []) by ietfa.amsl.com (Postfix) with ESMTP id 0BB5212006A for <doh@ietfa.amsl.com>; Tue, 26 Mar 2019 06:47:16 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.999
X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([]) by localhost (ietfa.amsl.com []) (amavisd-new, port 10024) with ESMTP id RZYmfxG3tLs6 for <doh@ietfa.amsl.com>; Tue, 26 Mar 2019 06:47:14 -0700 (PDT)
Received: from mail-qk1-x734.google.com (mail-qk1-x734.google.com [IPv6:2607:f8b0:4864:20::734]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1BE8A1202D1 for <doh@ietf.org>; Tue, 26 Mar 2019 06:47:14 -0700 (PDT)
Received: by mail-qk1-x734.google.com with SMTP id c189so7606274qke.6 for <doh@ietf.org>; Tue, 26 Mar 2019 06:47:14 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=ddsl8IyCxejzQHvbUm2WGhBrlZwBQs0/Gu9cq6lGymM=; b=CSsGC7KBmV7lZNfg/XIxCTmlUQfYzzt2ipI7cBhCvdRU02SRQ1b04/z51CcHIGr4zJ 9qXRI7uksopZNxzkEIIdZSdDFMBEDB4wyaXCGusXbfzGJwbKkNGR5k0qICgh3Fi0DXGK /N1ih974mrTf3Fx+zbuvU0fDFKM6b98xAw8aVUzorvCohcIQOlJhID7LXEKvU7DUTtM9 6LRCPNFuyJhZ5Vw4BRcKXiTYCwzd6ZrqLVBbYJMsVY/j0yo864QjIKY5b58cygnwIJE6 2Tyb8SKAqr/cX//9rkANOLKNkD6k11sTKMFTy/F0RHq9enuStInbi0zM3wPRD8VzD+8q q3Pw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=ddsl8IyCxejzQHvbUm2WGhBrlZwBQs0/Gu9cq6lGymM=; b=MiAQHThd11Oq9eXvvGdUfXPsa4Yc4asqvmg/kkQwWz2VBytj9fnSSky6NtOQakgRsF HwxDRsDNnNmzHtjp4Cz4jUXMp6BglSpuKPBOV/N7pxnw/656izyHGKfLkRNU6tZgiS53 Pol81N1N+AXmnG4QKzaZ1Vxnf11mXSyAR6oKFcshdbF6hfdFKLpa0i4+piOEmVcFnseo NU3Jejkfo/VVv2wZieN0EE/jBiP+Jhdw2zWvaiWY2XdKn2vt3J3lfYiS+FmG9uFQ66fp zVYgtliZ59t1FAvy3yHmAKAWUO5JxjTvmVXatyHdMefZzWO2/2SeABYjH9O5BGR6IGFI CotA==
X-Gm-Message-State: APjAAAWfDA6hdNFjorvlNO+VXDNmdJwlOum6DglHE/Ze/7oL5laoI/QK HZYVpPQVOQCzWVc8iOLpt+qQk0nEPXpJUHi2QC93I2Wh
X-Google-Smtp-Source: APXvYqxSpYziWs8OnysvcGgnkD/bO6jybHvrvVIr/pf2XBY+ZqUDkirsj3FyDIEvbxV8AVv93gMG5kH2px1sFFbG9ro=
X-Received: by 2002:a37:6814:: with SMTP id d20mr25170192qkc.102.1553608032832; Tue, 26 Mar 2019 06:47:12 -0700 (PDT)
MIME-Version: 1.0
From: Brian Dickson <brian.peter.dickson@gmail.com>
Date: Tue, 26 Mar 2019 14:47:01 +0100
Message-ID: <CAH1iCiqG3Rarc95yWJzz3Uq+uFHZermb18J-u2ST_hceh6Xrkw@mail.gmail.com>
To: DoH WG <doh@ietf.org>
Content-Type: multipart/alternative; boundary="000000000000ead0830584ff8e71"
Archived-At: <https://mailarchive.ietf.org/arch/msg/doh/TVJVrpxDRDP0mtVSpZjECO77FZs>
Subject: [Doh] Resolver-associated comments (mike follow-up)
X-BeenThere: doh@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: DNS Over HTTPS <doh.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/doh>, <mailto:doh-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/doh/>
List-Post: <mailto:doh@ietf.org>
List-Help: <mailto:doh-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/doh>, <mailto:doh-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 26 Mar 2019 13:47:16 -0000

Hi, DoH folks,

At the mike I had some comments, but it was recommended I put them on-list.
This is that.

One of the non-obvious challenges in any migration from a strict
DNS-over-UDP to anything else, is that there are some interesting DNS
topologies involving DNS Forwarders.

The basic UDP resolution path would generally be:
stub -> forwarder -> [forwarder ->][...] -> recursive/iterative resolver

This creates ambiguity in any single-common-name response(s) in elevating
from Do53 to Do{HT}.

Upgrades from traditional DNS forwarder, to Do{TH}, possibly still acting
as a forwarder, is the fundamental issue. It is possible that more than one
forwarder is upgraded. It is also not possible to determine which
forwarder(s) have upgraded. Since Do{TH} involves the client placing a
significant amount of trust (for privacy, security, and data integrity) in
the upgraded server, this seems important.

The idea is that a client would first do discovery of the names of upgraded
servers, and that the client would then select from those names (either via
configured preferences, or via a UI), and use that name for Do{TH}
connection to the selected server, explicitly and by name. This would
facilitate TLS validation of the name, which I believe improves the
security in ways that the current mechanisms don't seem to do.

I suspect this would require a new reserved query name or possibly new
opcode for the query.

It might require that the first responding server discover its upstream
forwarder/resolver name, and return both those upstream names plus its own

It does involve some degree of trust and transitive trust, but the
configuration of a DNS server inherently involves trust.

These are just initial thoughts, but I think there is potential solutions,
or at least problems, that might be in the above stuff.

Comments welcome.