Re: [Privacy-pass] Draft on key consistency and discovery

[Ben Schwartz <[e-mail]>]

On Fri, Feb 26, 2021 at 4:19 PM Eli-Shaoul Khedouri <eli=
[e-mail]> wrote:

>
>
> On Fri, Feb 26, 2021 at 12:28 PM Ben Schwartz <bemasc=
> [e-mail]> wrote:
>
>>
>>
>> On Thu, Feb 25, 2021 at 6:40 PM Matthew Finkel <[e-mail]>
>> wrote:
>>
>>> > For Privacy Pass, at least, there is potentially a presumption that the
>>> > user has access to the network in a way that hides their identity and
>>> does
>>> > not collude with the target.  This might mean that the user's DNS
>>> resolver
>>> > is presumed to be trusted.  In that model, the resolver could act like
>>> a
>>> > trusted proxy (Section 4.2).
>>>
>>> Yes, but that could be misleading. "One DNS resolver" does not
>>> necessarily translate into one DNS cache, especially not a global DNS
>>> cache, so the global consistency properties of DNS are a bit fuzzy.
>>>
>>
>> Yes.  On the other hand, an adversary can probably identify which
>> resolver cache instance you're hitting by putting a different IP in each
>> one, so privacy beyond that level may be an illusion.
>>
>
> This can be detected and mitigated by the client with TACK
> <http://tack.io/draft.html>-style pinning pools, but seems a bit out of
> scope for the core protocol.
>

I'm not familiar with TACK.  Are you suggesting that the domain would
commit to the universality of its IP addresses and other DNS records?
That's an interesting idea, though it might not be compatible with using
classic DNS for connection setup.