Re: [Doh] Authentication in draft-ietf-doh-resolver-associated-doh-03.txt

[tirumal reddy <[e-mail]>]

On Tue, 26 Mar 2019 at 11:25, Patrick McManus <[e-mail]> wrote:

>
>
> On Tue, Mar 26, 2019 at 9:48 AM tirumal reddy <[e-mail]> wrote:
>
>>
>> Agreed, and with our proposal in
>> https://tools.ietf.org/html/draft-reddy-dprive-bootstrap-dns-server-02,
>> the query for URI templates can use FQDN instead of
>> IP address, and the HTTPS server certificate can be validated by the DoH
>> client.
>>
>>
> right. The weakness here is that validating a name that probably comes
> from an unauthenticated source is not a very strong signal.
>

No, the name is coming from a authenticated source. The explicit trust
store to validate the local DoH server certificate can also be used to
validate the S-NAPTR lookup
response is authentic using DNSSEC.


> That seems inherent in the draft, but maybe worth calling out more
> explicitly.
>
> otoh - and out of scope for this draft - the DoH client could do some kind
> of validation beyond the name.. like looking for a x509 attribute (and
> cross signature) indicating some kind of better-business like endorsement
> of privacy practices.
>

The draft discusses a privacy certificate extension that helps the endpoint
identify the privacy preserving data policy of the DNS
server. The extension contains a URL that points to the privacy
preserving data policy.



> So I think validation in the scope of associated-resolver is a desirable
> property even though the usually validated thing, the name, is a little
> less valuable here.
>

The name is a reference identifier for validating the local DoH server
certificate.

Cheers,
-Tiru


>
>
>