Re: [Doh] [EXTERNAL] Re: [Ext] Request for the DOH WG to adopt draft-hoffman-resolver-associated-doh

["Winfield, Alister" <[e-mail]>]

I agree just looking at where information 'could' reside use available information and be signed using existing mechanisms. Note, I hate TXT too, NAPTR (+ SRV)  is closest to the requirement in the existing RR types but even that isn't perfect.

Issues this needs to show:
The security of the discovery mechanism,
How a discovered DOH end-point can be trusted (This is related to what the end-user believes is required to trust the TRR. Clearly some trust their ISP others would trust Google yet more would only trust their corporate DNS service)

Is there anywhere thoughts on how to define 'trust' and how that is published, audited, etc especially when you consider this form of discovery of a DOH capability?

A.


On 22/01/2019, 12:50, "Jim Reid" <[e-mail]> wrote:

    On 22 Jan 2019, at 12:15, Winfield, Alister <Alister.Winfield=[e-mail]> wrote:
    >
    > how about putting the information in the reverse zone for the resolver.
    >  ... This is delegated and could be DNSSEC signed.

    It won't work for RFC1918 address space.

    The bootstrapping problem isn’t solved either. Presumably you’d still be relying on DHCP or something equally insecure to get the IP addresses of the resolving servers.

    If a stub resolver gets configured in some other way -- editing /etc/resolv.conf for instance -- that might as well include whatever voodoo is needed for trusted DoH or DoT servers.

    And what if that reverse zone isn’t signed?

    Then there are the issues when that zone isn’t managed by the same entity which manages the corresponding forward zone. This is quite common. For example, if I was a Sky customer I very much doubt I’d be able to add/remove/replace one of these hypothetical RRs in whatever Sky reverse zone happens to be “hosting” the IP address of my DoH server today. And if/when I reconnect to your net and get a different IP address, what happens to the old TXT record?

    > If my resolver is a.b.c.d then you could put TXT records in the reverse..

    That’s a Bad Idea. TXT records are already overloaded (abused?) for all sorts of things. A discrete RRtype would be better. Assuming this suggestion got picked up.

Information in this email including any attachments may be privileged, confidential and is intended exclusively for the addressee. The views expressed may not be official policy, but the personal views of the originator. If you have received it in error, please notify the sender by return e-mail and delete it from your system. You should not reproduce, distribute, store, retransmit, use or disclose its contents to anyone. Please note we reserve the right to monitor all e-mail communication through our internal and external networks. SKY and the SKY marks are trademarks of Sky Limited and Sky International AG and are used under licence.

Sky UK Limited (Registration No. 2906991), Sky-In-Home Service Limited (Registration No. 2067075), Sky Subscribers Services Limited (Registration No. 2340150) and Sky CP Limited (Registration No. 9513259) are direct or indirect subsidiaries of Sky Limited (Registration No. 2247735). All of the companies mentioned in this paragraph are incorporated in England and Wales and share the same registered office at Grant Way, Isleworth, Middlesex TW7 5QD