Subject: [Doh] DNS API server trust

From: Mateusz Jończyk <[email-masked]>
Date: Fri, 11 May 2018 11:47:20 +0200

Hello,
There was an interesting discussion on a Github pull request
	https://github.com/dohwg/draft-ietf-doh-dns-over-https/pull/174

It was discussed whether there should be an absolute requirement which servers
the client can use, i.e. the following text:

	In the absence of DNSSEC information about the authenticity of responses
	a DNS API server can give a client invalid data in responses. A client
	MUST NOT use arbitrary DNS API servers. Instead, a client MUST only use
	DNS API servers specified using mechanisms such as explicit
	configuration. This does not guarantee protection against invalid data
	but reduces the risk.

User roryhewitt opposed this wording, He or She argued that usage of MUST is
unsuitable as it is used here to describe policy, not a mechanism.

I would side with His / Her. The concern is merely theoretical at the time being
as there is currently no other way to obtain a DNS API server other then manual
configuration (the usage of DNS responses obtained by server push is dealt
earlier in the specification). I would claim that concerns "that DOH clients
will spray queries to random webservers, or otherwise violate security common
sense." (as Benjamin M. Schwartz put it) are unfounded.

The policy should probably be defined after DNS API server discovery will be
standarized.

At the very least, I would lower the requirement from MUST to SHOULD here as
trust is an intricate topic.

Greetings,
Mateusz Jończyk

---

From: "Hewitt, Rory" <[email-masked]>
Date: Fri, 11 May 2018 16:36:36 +0000

Hey Mateusz,

Just as an FYI, I'm a he 😊

Rory

-----Original Message-----
From: Mateusz Jończyk [mailto:[email-masked]] 
Sent: Friday, May 11, 2018 2:47 AM
To: DoH WG <[email-masked]>
Subject: [Doh] DNS API server trust

Hello,

It was discussed whether there should be an absolute requirement which servers the client can use, i.e. the following text:

User roryhewitt opposed this wording, He or She argued that usage of MUST is unsuitable as it is used here to describe policy, not a mechanism.

I would side with His / Her. The concern is merely theoretical at the time being as there is currently no other way to obtain a DNS API server other then manual configuration (the usage of DNS responses obtained by server push is dealt earlier in the specification). I would claim that concerns "that DOH clients will spray queries to random webservers, or otherwise violate security common sense." (as Benjamin M. Schwartz put it) are unfounded.

The policy should probably be defined after DNS API server discovery will be standarized.

At the very least, I would lower the requirement from MUST to SHOULD here as trust is an intricate topic.

Greetings,
Mateusz Jończyk