Paul Hoffman <paul.hoff...@icann.org> wrote: > On Sep 20, 2020, at 4:45 PM, Tony Finch <d...@dotat.at> wrote: > > > > Why can't you just send client-subnet in a request and look at the answer? > > That assumes that an attacker in the middle has not removed the answer. > The indicator that we used as an initial idea for the capability would > be signed, meaning that the resolver would expect a client subnet > response and could act if it didn't get one.
OK, but how would the resolver's reaction differ? I.e. what problem is caused by resolvers lacking prior knowledge of client-subnet support? The more general solution for fixing traffic corruption is authenticated DoT, so it doesn't seem worth the effort to introduce a special mechanism to protect one EDNS option when DoT can do the job. Tony. -- f.anthony.n.finch <d...@dotat.at> http://dotat.at/ North Foreland to Selsey Bill: Southwesterly 3, increasing 4 or 5, then 6 or 7 later. Smooth becoming slight, then moderate later. Rain or showers later. Moderate or good. _______________________________________________ DNSOP mailing list DNSOP@ietf.org https://www.ietf.org/mailman/listinfo/dnsop
