Re: [IPsec] draft-pauly-ipsecme-split-dns

[Nico Williams <[e-mail]>]

On Tue, Jun 19, 2018 at 04:11:13PM -0700, Eric Rescorla wrote:
> On Tue, Jun 19, 2018 at 4:01 PM, Nico Williams <[e-mail]>
> wrote:
> > I don't know what the antecedent of "this" in your question.  If you
> > mean that BYODs will have to accept policies users don't want, well,
> > that's pretty much true anyways (e.g., you have to accept proxy
> > configurations that can and _will_ MITM you).
> 
> I'm asking if a common scenario will be that users of enterprise
> VPNs who implement this feature will end up in a situation where the
> VPN can impose TAs for any domain.

I think that will be (and probably already is) common in enterprises,
but not for public VPNs.

> As a followup question, I claim that that's not presently true with
> existing VPNs. In some cases, the VPN requires you to install
> a new trust anchor in order to accept its cert, but that's not an
> inherently necessary practice. Separately, an enterprise may
> require you to accept an MITM cert, but these are conceptually
> distinct. Do you disagree with that?

Requiring that the client accept arbitrary trust anchors in this
protocol is "not an inherently necessary practice" practice either.

Do you disagree?

The protocol's purpose is to enable split-dns, not to enable MITM for
all domains, though it does also do the latter if the client accepts it.

> > Are you objecting to the I-D altogether -- objecting to the feature it
> > adds -- or asking what the I-D should say about your concern?
> 
> Again, right now I'm trying to establish the facts of the matter. I'd
> prefer to do that prior to discussing what is good or bad.

My prediction of which configurations will be common is hardly a fact :)