Unique DoH path attack

[tireddy2]

Some options include: only allow common DoH paths (such as the de-facto default "/dns-query{?dns}"); performing consistency checks by fetching the information about the resolver over multiple resolution paths; or coordinating with a trusted oblivious relay to validate that DoH paths are common across clients using the same gateway.

Comment> The consistency check discussed above in security considerations section is not clear to me. For example, in case of DNR, the client will use DHCP/RA to learn the DoH path and it can use discovered ADN or Do53 to do the the SVCB lookup to cross-check both DoH paths are matching.

I don't get how the client will co-ordinate with a oblivious relay to validate that DoH path. Is the client supposed to use the de-facto URI path to retrieve the actual URI path from the Oblivious DoH service.

[tfpauly]

I was thinking that either you would:

• Check that the path in the SVCB response is the same if you look it up locally and publicly (two resolvers)
• Have some proprietary method to reveal what the interior DoH path is to the relay, and the relay can reject requests to paths that look like targeting.

[tireddy2]

I like the first approach compared to the proprietary method :)

[tireddy2]

I see draft-schwartz-ohai-consistency-doublecheck solves the problem by including the DoH path in the service description host.

[tfpauly]

Yeah, that works if you have some such dictionary file.

[tireddy2]

we may want to consider using a separate section to list the possible remediation mechanisms to detect unique DoH path attack.