Re: [Doh] [Ext] WGLC on draft-ietf-doh-dns-over-https

[Alexander Mayrhofer <[e-mail]>]

Hello,

[comments inline on Padding]

On Wed, May 2, 2018 at 1:42 PM, Sara Dickinson <[e-mail]> wrote:
>> I'm not sure why there are "problems" with these. For padding, the server can use it or not.
>
> For me the issue is simply that HTTP padding is specifically mentioned in the draft (several times) but that EDNS(0) isn’t mentioned at all. A simple statement in Section 6 to the effect that ‘DNS API clients and servers may use EDNS(0) padding [RFC7830] in the DNS wire format independently of whether or not HTTP padding is used.’ would suffice I think.

I do agree with Sara on this. It seems incomplete to mention HTTP
padding a few times, but not mention DNS padding at all, given that
the protocol is a "mixture" of both worlds.

And remembering a few discussions i had with fellow encryption gurus,
it seems preferrable to perform padding at the "innermost" level,
where the application has the greatest extent of control over whether
or not padding has been performed, and to what extent. Looking at the
layering of DOH, that probably means that EDNS padding gives an app
more control than HTTP padding, and HTTP padding gives an application
more control than padding on the TLS layer.

Therefore, i do suggest that we do mention EDNS padding as at least an
equal choice to HTTP padding.  I can prepare text (or a pull request
if that is preferred).

best,
Alex