[Doh] Resolver-associated comments (mike follow-up)
Brian Dickson <brian.peter.dickson@gmail.com> Tue, 26 March 2019 13:47 UTC
Return-Path: <brian.peter.dickson@gmail.com>
X-Original-To: doh@ietfa.amsl.com
Delivered-To: doh@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0BB5212006A for <doh@ietfa.amsl.com>; Tue, 26 Mar 2019 06:47:16 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.999
X-Spam-Level:
X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RZYmfxG3tLs6 for <doh@ietfa.amsl.com>; Tue, 26 Mar 2019 06:47:14 -0700 (PDT)
Received: from mail-qk1-x734.google.com (mail-qk1-x734.google.com [IPv6:2607:f8b0:4864:20::734]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1BE8A1202D1 for <doh@ietf.org>; Tue, 26 Mar 2019 06:47:14 -0700 (PDT)
Received: by mail-qk1-x734.google.com with SMTP id c189so7606274qke.6 for <doh@ietf.org>; Tue, 26 Mar 2019 06:47:14 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=ddsl8IyCxejzQHvbUm2WGhBrlZwBQs0/Gu9cq6lGymM=; b=CSsGC7KBmV7lZNfg/XIxCTmlUQfYzzt2ipI7cBhCvdRU02SRQ1b04/z51CcHIGr4zJ 9qXRI7uksopZNxzkEIIdZSdDFMBEDB4wyaXCGusXbfzGJwbKkNGR5k0qICgh3Fi0DXGK /N1ih974mrTf3Fx+zbuvU0fDFKM6b98xAw8aVUzorvCohcIQOlJhID7LXEKvU7DUTtM9 6LRCPNFuyJhZ5Vw4BRcKXiTYCwzd6ZrqLVBbYJMsVY/j0yo864QjIKY5b58cygnwIJE6 2Tyb8SKAqr/cX//9rkANOLKNkD6k11sTKMFTy/F0RHq9enuStInbi0zM3wPRD8VzD+8q q3Pw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=ddsl8IyCxejzQHvbUm2WGhBrlZwBQs0/Gu9cq6lGymM=; b=MiAQHThd11Oq9eXvvGdUfXPsa4Yc4asqvmg/kkQwWz2VBytj9fnSSky6NtOQakgRsF HwxDRsDNnNmzHtjp4Cz4jUXMp6BglSpuKPBOV/N7pxnw/656izyHGKfLkRNU6tZgiS53 Pol81N1N+AXmnG4QKzaZ1Vxnf11mXSyAR6oKFcshdbF6hfdFKLpa0i4+piOEmVcFnseo NU3Jejkfo/VVv2wZieN0EE/jBiP+Jhdw2zWvaiWY2XdKn2vt3J3lfYiS+FmG9uFQ66fp zVYgtliZ59t1FAvy3yHmAKAWUO5JxjTvmVXatyHdMefZzWO2/2SeABYjH9O5BGR6IGFI CotA==
X-Gm-Message-State: APjAAAWfDA6hdNFjorvlNO+VXDNmdJwlOum6DglHE/Ze/7oL5laoI/QK HZYVpPQVOQCzWVc8iOLpt+qQk0nEPXpJUHi2QC93I2Wh
X-Google-Smtp-Source: APXvYqxSpYziWs8OnysvcGgnkD/bO6jybHvrvVIr/pf2XBY+ZqUDkirsj3FyDIEvbxV8AVv93gMG5kH2px1sFFbG9ro=
X-Received: by 2002:a37:6814:: with SMTP id d20mr25170192qkc.102.1553608032832; Tue, 26 Mar 2019 06:47:12 -0700 (PDT)
MIME-Version: 1.0
From: Brian Dickson <brian.peter.dickson@gmail.com>
Date: Tue, 26 Mar 2019 14:47:01 +0100
Message-ID: <CAH1iCiqG3Rarc95yWJzz3Uq+uFHZermb18J-u2ST_hceh6Xrkw@mail.gmail.com>
To: DoH WG <doh@ietf.org>
Content-Type: multipart/alternative; boundary="000000000000ead0830584ff8e71"
Archived-At: <https://mailarchive.ietf.org/arch/msg/doh/TVJVrpxDRDP0mtVSpZjECO77FZs>
Subject: [Doh] Resolver-associated comments (mike follow-up)
X-BeenThere: doh@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: DNS Over HTTPS <doh.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/doh>, <mailto:doh-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/doh/>
List-Post: <mailto:doh@ietf.org>
List-Help: <mailto:doh-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/doh>, <mailto:doh-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 26 Mar 2019 13:47:16 -0000
Hi, DoH folks, At the mike I had some comments, but it was recommended I put them on-list. This is that. One of the non-obvious challenges in any migration from a strict DNS-over-UDP to anything else, is that there are some interesting DNS topologies involving DNS Forwarders. The basic UDP resolution path would generally be: stub -> forwarder -> [forwarder ->][...] -> recursive/iterative resolver This creates ambiguity in any single-common-name response(s) in elevating from Do53 to Do{HT}. Upgrades from traditional DNS forwarder, to Do{TH}, possibly still acting as a forwarder, is the fundamental issue. It is possible that more than one forwarder is upgraded. It is also not possible to determine which forwarder(s) have upgraded. Since Do{TH} involves the client placing a significant amount of trust (for privacy, security, and data integrity) in the upgraded server, this seems important. The idea is that a client would first do discovery of the names of upgraded servers, and that the client would then select from those names (either via configured preferences, or via a UI), and use that name for Do{TH} connection to the selected server, explicitly and by name. This would facilitate TLS validation of the name, which I believe improves the security in ways that the current mechanisms don't seem to do. I suspect this would require a new reserved query name or possibly new opcode for the query. It might require that the first responding server discover its upstream forwarder/resolver name, and return both those upstream names plus its own name. It does involve some degree of trust and transitive trust, but the configuration of a DNS server inherently involves trust. These are just initial thoughts, but I think there is potential solutions, or at least problems, that might be in the above stuff. Comments welcome. Brian
- [Doh] Resolver-associated comments (mike follow-u… Brian Dickson