Re: [mif] Comments on draft-ietf-mif-dns-server-selection-01

[Ted Lemon <[e-mail]>]

On Mar 29, 2011, at 12:29 AM, "[e-mail]" <[e-mail]> wrote:

I think there are four cases to consider here:

1. The server selection option is delivered across a secure, trusted channel.
2. The server selection option is not secure, but the client does DNSSEC validation.
3. The server selection option is not secure, the resolver does DNSSEC validation, and the client communicates with the resolver over a secure, trusted channel.
4. The DNS server IP address that is being recommended in the server selection option is known and trusted by the client; that is, the server selection option serves not to introduce the client to a new server, but rather to inform it that a server it has already been configured to trust is available to it for resolving certain domains.

I think any use of the server selection option that falls outside of these four cases should be excluded.   By excluding such cases, we eliminate the possibility that the server selection option can be used to initiate an attack that could not be initiated without it.

I think that trusting the cell provider connection is something that needs to be thought through carefully.   It may in fact be okay to do so.   But it depends on that channel being both secure and trusted, not just trusted.  In DHCP it's somewhat traditional to trust provider channels even though they aren't cryptographically secure, and we get away with this because they are in fact in secure locations, and the information we're trusting isn't that sensitive.   But those two rationalizations don't apply here--cell service is done by radio, and hence not in a secure location, and the information we propose to trust is in fact quite sensitive.