[Doh] draft-ietf-doh-resolver-associated-doh-02 comments

[Stephen Farrell <[e-mail]>]

Hiya,

I had a read of this.

I think I share Martin's general concerns, but don't have a
concrete high-level suggestion other than to talk more about
it and be open to possibly big changes being needed as we
work it out.

Points that might be worth clarifying as we go:

- Section 2: what about OCSP? are we assuming that the OCSP
responder is resolved by the precursor system resolver or
the DoH resolver or both? I don't think it makes a security
difference (OCSP works or doesn't as usual), but it may be
a gotcha in terms of establishing the TLS session. Or, are
we assuming there's no point in OCSP for an IP-address
cert? (I forget;-)

- Section 2: "the normal rules for HTTP" - does that mean
all re-directs MUST be HTTPS too? And can those URLs use
DNS names or must they be IP address certs too?

- Sections 3 & 4: the use of special-use domain names here
seems ickky to me. ("ickky" being a technical terms for "I
don't like that but can't justify my opinion" :-) I think
it'd be a pity to see more crap DNS queries emitted from
browsers though and would love to see something better. I
also wonder what'd happen with these queries in a home n/w
with a never-updated router or with a brand-new flashy
home router that e.g. has a public DNS name. (In that
latter case, I can easily get a cert for the name of my
home router, but not for it's IP address.)

- Section 7, para 1: that's way too one-sided. DoH could
be less privacy-friendly (than say DoT) due to cookies and
whatnot.

- Section 8: Why diss. DoT? It's not a competition:-)

Cheers,
S.