Speaker
Description
Opportunistic encryption of recursive to authoritative transports (Op-ADoX) is still in the early days of development and deployment. Unilateral (but blind) probing of alternative transports suggested in RFC9539 has seen only limited deployment to-date for a variety of reasons, and end users are not yet benefiting from the range of protections offered by Op-ADoX.
In this talk we will describe an new mechanism that enables a more controlled deployment of Opportunistic encrypted transports: Opportunistic Operator Transport Signaling mechanism (OOTS). This signalling is based on SVCB records which can contain a new (experimental) SVCB "oots" key that specifies per-transport query load parameters. This improves on blind probing by providing a mechanism by which a responding authoritative server may signal which alternative transports it supports, along with more detailed information about each transport.
We will describe both the Passive and Probe modes recursive resolvers can use to discover these SVCB records and highlight the minimal level of changes required to the DNS protocol to deploy this mechanism. We also describe how OOTS focusses on enabling zone operators to manage the deployment of encrypted transports rather than zone owners. Finally we will describe early implementations and test deployments.
| Talk duration | 10 Minutes (+5 for Q&A) |
|---|
