IETF Logo Mail Archive

Re: [Doh] Authoritative DoT or DoH

Erik Kline <ek@loon.co> Fri, 15 March 2019 03:23 UTC

Return-Path: <ek@google.com>
X-Original-To: doh@ietfa.amsl.com
Delivered-To: doh@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5A9F5129A87 for <doh@ietfa.amsl.com>; Thu, 14 Mar 2019 20:23:46 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -9.498
X-Spam-Level:
X-Spam-Status: No, score=-9.498 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=loon.co
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MbtjVZfJgw17 for <doh@ietfa.amsl.com>; Thu, 14 Mar 2019 20:23:43 -0700 (PDT)
Received: from mail-it1-x129.google.com (mail-it1-x129.google.com [IPv6:2607:f8b0:4864:20::129]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A32D51310D4 for <doh@ietf.org>; Thu, 14 Mar 2019 20:23:43 -0700 (PDT)
Received: by mail-it1-x129.google.com with SMTP id l15so8700880iti.4 for <doh@ietf.org>; Thu, 14 Mar 2019 20:23:43 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=loon.co; s=google; h=mime-version:references:in-reply-to:reply-to:from:date:message-id :subject:to:cc; bh=E23ROFRVKAzQ14jXwIID9jIfZtXIaEXW+Wsn/3L6Q30=; b=GWZIJ2SbET+s49O1M0nA2etzJiRli8JY6578Jsknl4DZTPfQahPQ7vlw8sRcp01AA3 tx6y6TktBnxNJvQYtKqESlNuG0yD1Wb0ifCxAao6pO/1+B1+XbsOrnDOXv7ycSCx2VCV 3JfQGWkb+ozohl4fqUuRMc6TPWvMZmsTca6v0=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:reply-to :from:date:message-id:subject:to:cc; bh=E23ROFRVKAzQ14jXwIID9jIfZtXIaEXW+Wsn/3L6Q30=; b=ezkdTzdIGv6lBCih1PQVok+K3C8H/pNrZjyOfyYMQk6DKL31h0N2J/XlT/8BGhP0zk cDmJtg+bG73SedXWflyHGz01K69gwwCgeNKCH+MpfGt35Kouq3bItrP8rLwTso3erfhP qGc9GpEn0L7WbdINKl0F2lM1SiUTtI5w2w7dJucMSTlM2cNL7GrnG0JFIGPLfhC+Ps/b TZYQjJgC4y75Daooy2ud4aB0ev025TigYXihG/DMNsknqPgS+UqU6noi0+qXmiW3soeP 243w77SDcqojB2FsbBCEY3qUsKx+ZB/6Ynp/JiFQ6Qg6QiCtSU8s0Iadddwm1+5zjCUs SCpw==
X-Gm-Message-State: APjAAAUbdSJRepEhVVA5MLWPmgTAB3sNDcm3Vdwa5A0LNMpqiu2qp7X8 KYMmuVIxyzw2msj7K89TOu6GPNCZmTgGLujIhVKyyQEzI6U=
X-Google-Smtp-Source: APXvYqwiX9FZlW6kqkhmVAdG3g+IV+wx4DXDzn98czAcQzc4uMHXDcjA69fcD/cqFh2KUwqoBXso5M9aZoDIQHt/Jhs=
X-Received: by 2002:a24:cc89:: with SMTP id x131mr537272itf.121.1552620222585; Thu, 14 Mar 2019 20:23:42 -0700 (PDT)
MIME-Version: 1.0
References: <C8284F2D-F46A-484E-A145-99C0D8ADBC58@verisign.com> <73eb005a-da34-41cb-a05d-1cb8268060d2@www.fastmail.com>
In-Reply-To: <73eb005a-da34-41cb-a05d-1cb8268060d2@www.fastmail.com>
Reply-To: ek@loon.co
From: Erik Kline <ek@loon.co>
Date: Thu, 14 Mar 2019 20:23:31 -0700
Message-ID: <CAAedzxqFMe_tZkBbXSWjfAgajaO1v=sX6umzcpfv+OaaQKOn6g@mail.gmail.com>
To: Martin Thomson <mt@lowentropy.net>
Cc: doh@ietf.org
Content-Type: multipart/alternative; boundary="000000000000d71fd705841990a6"
Archived-At: <https://mailarchive.ietf.org/arch/msg/doh/Td15UwhLu9r2r-REXzqdYyQEDQI>
Subject: Re: [Doh] Authoritative DoT or DoH
X-BeenThere: doh@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: DNS Over HTTPS <doh.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/doh>, <mailto:doh-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/doh/>
List-Post: <mailto:doh@ietf.org>
List-Help: <mailto:doh-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/doh>, <mailto:doh-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 15 Mar 2019 03:23:46 -0000

And on account of the load management issues I would expect some folks to
prefer to try out DoQ (DNS over QUIC), does actually bring things back
around to DoH.

On Thu, 14 Mar 2019 at 19:27, Martin Thomson <mt@lowentropy.net> wrote:

> There is far less reason to use DoH for connections to authoritative
> servers.  DoT seems far more appropriate (than both DoH and the unencrypted
> variants).
>
> I expect there to be a lot of discussion about DoS (not DNS over SCTP,
> sadly) and load management in any such document.  I don't see much of the
> stuff that has generated so much heat lately to be relevant in the
> authoritative context.
>
> On Fri, Mar 15, 2019, at 06:18, Henderson, Karl wrote:
> >
> > In the last couple of days there has been a lot of activity concerning
> > DNS over HTTPS (DoH) - Hoffman and Alibaba presentations at ICANN and
> > IETF drafts:
> >
> draft-reid-doh-operator/draft-livingood-doh-implementation-risks-issues/draft-betola-bcp-doh-clients.
> >
> >
> > These discussions have focused on DoH for client (typically web
> > browser) communication with recursive resolvers, and its comparisons
> > with DoT for this purpose.
> >
> >
> > Is there any compelling reason at this point to be considering DoH for
> > recursive resolver-to-authoritative name server communications?
> >
> >
> > As I noted at the DPRIVE interim meeting, the working group needs
> > empirical studies looking at performance and attack vectors for
> > authoritative DNS encryption.
> >
> >
> > Unless there are compelling reasons to consider Authoritative DoH, I
> > propose the working group focus its authoritative DNS encryption
> > assessments around Authoritative DoT.
> >
> >
> > In support, I am willing to co-author an Authoritative DoT operational
> > consideration draft in order to outline the operational challenges the
> > community needs to address - similar to the draft-reid-doh-operator
> > draft between client and recursive.
> >
> >
> > _______________________________________________
> > Doh mailing list
> > Doh@ietf.org
> > https://www.ietf.org/mailman/listinfo/doh
> >
>
> _______________________________________________
> Doh mailing list
> Doh@ietf.org
> https://www.ietf.org/mailman/listinfo/doh
>

v2.23.0 | Report a Bug | By Email