[Doh] Authentication in draft-ietf-doh-resolver-associated-doh-03.txt

[Paul Hoffman <[e-mail]>]

On Mar 25, 2019, at 12:01 PM, Stéphane Bortzmeyer <[e-mail]> wrote:
> Otherwise, even after reading the whole thread "Reviewing
> Resolver-Associated DOH", I don't understand why https is required in
> section 2. We don't require DNSSEC in section 3, so why having
> stronger requirments for HTTP? Since having certificates for IP
> addresses will be difficult in practice, why not just accepting http
> as well as https? (Or, <horror>https without cert. checking</horror>.)

The reason I didn't drop down to http: is that doing so evokes the <horror> response, even though you are quite correct that the other two methods given in this document do not offer any authentication. So, let me ask the WG:

Would this document be better off with all three methods being equally unauthenticated? Doing so would remove the "but you can't get IP address certificates!" argument that keeps coming up (even though that is overstated). Doing so would simplify the security considerations by making all three protocols have the same obvious weakness.

An alternative is to have two URI, one with https: and one with http:, and explain that trying the first might be a good idea but to fall back to the second if authentication fails.

Thoughts?

--Paul Hoffman