Subject: [dns-privacy] DoT between recursive and authoritative pilot

From: manu tman <[email-masked]>
Date: Fri, 21 Dec 2018 18:59:43 -0800

Hi list,

As some you already know, Cloudflare and Facebook have been running a pilot
on using DoT between Cloudflare DNS and Facebook authoritative name servers.
You can read more about it at
https://code.fb.com/security/dns-over-tls/

Thanks
Manu

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Thu, 27 Dec 2018 17:32:47 +0100

On Fri, Dec 21, 2018 at 06:59:43PM -0800,
 manu tman <[email-masked]> wrote 

> https://code.fb.com/security/dns-over-tls/

Thanks. Very useful.

I do not find how the Cloudflare resolver discovers that Facebook
authoritative name servers use DNS-over-TLS, and what are their
keys. Hardwired in the resolver for the experiment?

---

From: Erik Kline <[email-masked]>
Date: Thu, 27 Dec 2018 10:48:55 -0800

> keys. Hardwired in the resolver for the experiment?

I think discovery is easy, you just try TCP port 853:

    for i in $(dig -t NS +short facebook.com | sort); do echo "[ $i ]";
openssl s_client -connect ${i}:853 </dev/null | openssl x509 -text -noout;
done

shows me that both a&b .ns.facebook.com are listening on 853 and present a
cert.

The subject for the cert is not especially illuminating, though.  I tried
sending the resolver name via SNI and got the same cert back.

Frankly, SNI + checking the cert is valid for the nameserver hostname seems
sufficient to me in the general case.

---

From: manu tman <[email-masked]>
Date: Thu, 27 Dec 2018 15:08:03 -0800

> sending the resolver name via SNI and got the same cert back.

We have used a preconfigured SPKI digest pinning. This was the easiest to
get the experiment going and focusing on the impact of DoT as a transport.

How to enable DoT discovery is yet to be discussed and defined. Discussions
have started since the last dprive virtual meeting, all have their pros and
cons but at least it seems constructive threads have been going on and we
are getting a better grasp of what makes sense for the different operators
involved.

Manu