Re: [dnsext] draft-mohan-dns-query-xml-00.txt

[Ted Hardie <[e-mail]>]

On Mon, Oct 3, 2011 at 12:22 PM, Mohan Parthasarathy <[e-mail]>wrote;wrote:

> On Mon, Oct 3, 2011 at 10:32 AM, Ted Hardie <[e-mail]> wrote:
> > On Mon, Oct 3, 2011 at 10:21 AM, Paul Hoffman <[e-mail]>
> wrote:
> >
> > I'm also increasingly of the opinion that this should have the validation
> > bits sets by default.  Allowing a web site to update the local DNS cache
> for
> > a client system by including a reference and a DNS result for the
> reference
> > causes my paranoia to ratchet up a few notches.  The only other defense
> > against it I see is using Web results only in same-origin web contexts,
> and
> > that's going to be very hard to make work.
> >
>
> I am not sure I understand this concern fully. I guess you mean that
> you want to use this only with CD =1 which also implies that you want
> to use only with DNSSEC . Though this is the primary use case that
> this draft is trying to address, should we restrict it ? Previously,
> your concern was cache poisoning of the HTTP proxies having an impact
> on DNS. If we require HTTPS and POST, is this still a concern ?
>
>
Well, I don't think you can functionally say that it can only be used with
DNSSEC at the protocol level; there's always the risk that you want to use
it for some zone that hasn't been signed.  But I think we're going to have
to strongly suggest that it should be used when DNSSEC validation can be
done and, if it has not been, how to handle the results with respect to the
local cache.

If I am a helpful web site with the ability to do this DNS return, I could
theoretically get slightly higher speed for web page loads by providing the
DNS data for the component loads along with the initial return.  If those
can be trusted because of DNSSEC validation, using the data and storing it
in the local cache for use by other applications (subject to TTL expiry
etc.) should be fine.  But if I cannot validate it, then I have to have some
other trust model for the data.  One potential model is to use (but likely
not store) data with the same origin as the web server from which I got it.
So if I land at financial.example.com, I use the data it gives me for
nasdaq.financial.example.com and sp500.financial.example.com, but not for
ftse.example.co.uk or, even worse, for social.network.com of
deposit.bank.com.

It's still a cache poisoning problem, but it is the local cache that might
be poisoned in this worry.

In the case where you are getting this from a 3rd party DNS provider which
supports HTTPS transport, the trust is presumably between you and that
provider.  That may be the initial use case.  But I'm guessing that once
this is available, other uses, included blended content/DNS returns will
occur.

regards,

Ted



-mohan
>
> > Ted
> >
> > _______________________________________________
> > dnsext mailing list
> > [e-mail]
> > https://www.ietf.org/mailman/listinfo/dnsext
> >
> >
>

_______________________________________________
dnsext mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/dnsext