|
|
|
|
|
|
by zamadatix
2358 days ago
|
|
|
Putting the keys over DNS seems really clever. With DoH are requests bundled in a single session or is the session stood up and torn down per? I assume it's the former or this proposal wouldn't have gotten far but I've never actually bothered to check that far into DoH. |
|
|
In your first (1-RTT) DNS lookup you agree a PSK (a secret key) with the DNS via DoH server.
On the next DNS via DoH lookup you send only one message, it goes like this:
Hi, it's me again. (The rest of the message is encrypted using the PSK). Here's a freshness check. I want to ask AAAA? www.google.com and also let's agree a new key for the next time I do this. Thanks, bye.
The DoH server will probably reply like this:
Hi. (The entire rest of the message is encrypted using the PSK). Here's proof I'm still me passing your freshness check. AAAA www.google.com answer is some:ipv6:address and yes, here is a new PSK for next time.
This is the same number of messages back and forth as with traditional UDP DNS albeit the messages are a little bit bigger now, and so it incurs the same latency.
Because this is 0-RTT the DoH server can't always be sure if it has seen your query before (doing this is trivial in a toy system with e.g. one DoH server on a Linux box but hard at scale with a distributed system). So a bad guy could replay the query. But, it's just a DNS query so replaying it doesn't achieve anything useful, and this doesn't help the bad guy learn anything about the query, they don't get to find out what it said or what the answer means.
[ Edited to remove mis-remembered DH for resumption, alas TLS 1.3 resumption PSKs are not forward secret ]