[Iotops] Encrypted DNS and draft-mishra-iotops-iot-dns-guidelines

[Hannes Tschofenig <[e-mail]>]

Hi all,

I would like to follow up on the discussion from the IETF IOTOPS WG 
meeting regarding draft-mishra-iotops-iot-dns-guidelines and the role of 
encrypted DNS in IoT deployments.

As I mentioned at the microphone, we need to be more precise about the 
privacy properties we aim to achieve. There is a good IAB document (IETF 
RFC 6973) that defines terminology, which could be re-used.
Encrypted DNS alone offers limited protection if the TLS Client Hello 
remains unencrypted since the SNI still reveals the target server. This 
is especially relevant if the goal is to conceal the FQDN the IoT device 
is attempting to connect to.

After checking, I noticed that WolfSSL already supports Encrypted Client 
Hello. Congrats to them!

That said, even the combination of Encrypted DNS and Encrypted Client 
Hello may not be sufficient to prevent device fingerprinting, depending 
on how the fingerprinting is performed.

The point raised during the meeting that a "toaster" can be linked to a 
household is valid. However, an ISP can already associate devices to 
households based on IP addresses, independently of DNS. Whether such 
information is actually useful in practice remains an open question.

A valuable discussion point would be whether, and under what conditions, 
attacks on DNS constitute a real threat to IoT devices, especially when 
their communication channels are protected by TLS, DTLS, or similar 
protocols.

Finally, I would be interested in exploring how the work in the DANCE 
working group might relate to this draft.

Ciao
Hannes