Re: [Doh] [Ext] WGLC on draft-ietf-doh-dns-over-https

[Paul Hoffman <[e-mail]>]

On May 2, 2018, at 7:46 AM, Mark O <[e-mail]> wrote:
> 
>  The charter for the DOH working group states that “The working group will analyze the security and privacy issues that could arise from accessing DNS over HTTPS”.

It does. However, it does not say that the protocol document has to do so.

> I’d like to suggest that the section on Security Considerations of draft-ietf-doh-dns-over-https should include text on the impact on cyber defence.

It might be better dealt with in a standalone document. Given that the IETF historically takes at least a year to "agree" on wording relating to this, causing the protocol document to wait for such agreement might be bad. For example, I find some of the wording you proposed to be highly biased towards "middleboxes have a right to inspect". Others might find your wording too weak, and would want more wording along the lines of "security middleboxes already inspect DNS messages, and DOH is preventing that, so DOH hurts security". There are literally thousands of messages on this topic on various IETF mailing lists in the past few years.

Further, the wording proposed is as appropriate for DNS-over-TLS as for DOH (with slightly different security and privacy considerations), and thus a separate document that deals with both of them would actually be more helpful than just doing it for DOH.

--Paul Hoffman