Subject: Q: Automatic, secure proxy selection

From: Toerless Eckert <[email-masked]>
Date: Sun, 19 Jul 2020 18:51:03 +0200

I hope a (simple?) user question is acceptable on this list, apologize if not.

What (if any) IETF/W3C standards exist to complete the following workflow:

- all for client/initiator (eg.: browser)
- Assume some DoH method for DNS lookups
- DNS lookup for www.example.com
- get in reply something like: (?)
    www.example.com trusts the following proxy.com
- Build TLS connection to proxy.com (?)
- Tunnel end-to-end https connection to www.example.com across (?)
    that TLS connection to proxy.com
    Aka: do not want proxy.com to be able to decrypt end-to-end payload.

Aka: I am am unclear if there are appropriate DNS RRs to support the
following steps and if/how it is actually possible to have end-to-end
encryption across such an also encrypted proxy connection. 

The use-case is obvious not to have network layer exposure on
the path between client and proxy that the connection is with www.example.com
and on path between proxy and www.example.com that connection is for client.

Thanks!
    Toerless

---

From: Mark Nottingham <[email-masked]>
Date: Mon, 20 Jul 2020 17:02:14 +1000

This question is likely better asked on the DoH or another list, as it's not specific to HTTP.

Cheers,

> On 20 Jul 2020, at 2:51 am, Toerless Eckert <[email-masked]> wrote:
> 

--
Mark Nottingham   https://www.mnot.net/

---

From: Toerless Eckert <[email-masked]>
Date: Mon, 20 Jul 2020 09:19:59 +0200

> This question is likely better asked on the DoH or another list, as it's not specific to HTTP.

Thanks, Mark, i can ask there too, but i was thinking that the
particular proxy functionality would be specific to http.

E.g.: can i tunnel e2e encrypted through a http proxy ?

Cheers
  Toerless

-- 
---
[email-masked]

---

From: Paul Vixie <[email-masked]>
Date: Mon, 20 Jul 2020 07:44:26 +0000

> This question is likely better asked on the DoH or another list, as it's not

mine is. since dhcp is not secure, and since i won't permit any device on my 
home or corporate network to call its external mothership using crypto, i 
operate a proxy which devices on my home or corporate network must trust and 
must use. no exceptions.

how am i expected to tell alexa, siri, hey, chromecast, and the rest of the 
embedded devices my family and employees want to use, that they have to use a 
proxy if they want to reach the outside world?

this isn't DoH specific, though DoH as an HTTP use case is affected by it.

the user-centric / app-centric network model assumes that all on-path 
attackers are oppositional, like evil ISP's or authoritarian governments. i'm 
neither, i'm just a head of household and a CEO, and i will be held 
responsible for whatever traffic my network emits, and i want to exercise that 
responsibility wisely.

toerless's question resonated with me.

-- 
Paul

---

From: Mark Nottingham <[email-masked]>
Date: Mon, 20 Jul 2020 17:49:19 +1000

> On 20 Jul 2020, at 5:19 pm, Toerless Eckert <[email-masked]> wrote:
> 

I think you're looking for CONNECT - 
  https://httpwg.org/specs/rfc7231.html#CONNECT

Cheers,