Re: [mif] Comments on draft-ietf-mif-dns-server-selection-01

[<[e-mail]>]

Then maybe something like (slight modification):
--
A node MAY request and accept OPTION_DNS_SERVER_SELECT in any of the following four cases. In other cases the node MUST NOT request or accept OPTION_DNS_SERVER_SELECT unless the node is specifically configured to do so.

1. The server selection option is delivered across a secure, trusted channel.
2. The server selection option is not secured, but the client on a node does DNSSEC validation.
3. The server selection option is not secured, the resolver does DNSSEC validation, and the client communicates with the resolver configured with server selection option over a secure, trusted channel.
4. The DNS server IP address that is being recommended in the server selection option is known and trusted by the client; that is, the server selection option serves not to introduce the client to a new server, but rather to inform it that a server it has already been configured to trust is available to it for resolving certain domains.
--
Where the case 4 could happen? When the trusted DNS server address is configured via some secure channel (e.g. administratively)?

The cellular interface (handset to first hop router) is AFAIK considered cryptographically secure. But anyhow, decision whether a channel is secure enough or not needs to be done case by case (e.g. by 3GPP(2), WiMAX Forum, BBF...).

Best regards,

	Teemu


> -----Original Message-----
> From: ext Ted Lemon [mailto:[e-mail]]
> Sent: 29. maaliskuuta 2011 08:48
> To: Savolainen Teemu (Nokia-MS/Tampere)
> Cc: [e-mail]; [e-mail]
> Subject: Re: [mif] Comments on draft-ietf-mif-dns-server-selection-01
> 
> On Mar 29, 2011, at 12:29 AM, "[e-mail]"
> <[e-mail]> wrote:
> 
> I think there are four cases to consider here:
> 
> 1. The server selection option is delivered across a secure, trusted
> channel.
> 2. The server selection option is not secure, but the client does
> DNSSEC validation.
> 3. The server selection option is not secure, the resolver does DNSSEC
> validation, and the client communicates with the resolver over a
> secure, trusted channel.
> 4. The DNS server IP address that is being recommended in the server
> selection option is known and trusted by the client; that is, the
> server selection option serves not to introduce the client to a new
> server, but rather to inform it that a server it has already been
> configured to trust is available to it for resolving certain domains.
> 
> I think any use of the server selection option that falls outside of
> these four cases should be excluded.   By excluding such cases, we
> eliminate the possibility that the server selection option can be used
> to initiate an attack that could not be initiated without it.
> 
> I think that trusting the cell provider connection is something that
> needs to be thought through carefully.   It may in fact be okay to do
> so.   But it depends on that channel being both secure and trusted, not
> just trusted.  In DHCP it's somewhat traditional to trust provider
> channels even though they aren't cryptographically secure, and we get
> away with this because they are in fact in secure locations, and the
> information we're trusting isn't that sensitive.   But those two
> rationalizations don't apply here--cell service is done by radio, and
> hence not in a secure location, and the information we propose to trust
> is in fact quite sensitive.