Internet Key Exchange Protocol Version 2 (IKEv2) Configuration for Encrypted DNS
Extracted elements (28)
A single attribute carries both the ADN and IP addresses (rather than reusing INTERNAL_IP6_DNS/INTERNAL_IP4_DNS) so that name and address are bound together atomically, as suggested by Yoav Nir and Paul Wouters during design review.
AliasMode (Service Priority = 0 per RFC 9460) is explicitly not supported because it would trigger additional Do53 queries to resolve the aliased name, whereas the required data can be supplied directly in the IKE response without additional round trips.
The ENCDNS_DIGEST_INFO attribute enables certificate pinning via SPKI hash without requiring the VPN client to be provisioned with a private CA root certificate; the encrypted DNS resolver can obtain a domain-validated certificate from a public CA, and the IKEv2 channel provides a trusted delivery path for the SPKI hash.
Existing VPN client implementations might not expect discovered DNS resolver IP addresses to be outside the covered IP address ranges of the VPN tunnel; implementations should be prepared for this scenario when encrypted DNS is deployed.
RFC 8598 requires INTERNAL_IP6_DNS or INTERNAL_IP4_DNS to be present when INTERNAL_DNS_DOMAIN is included; this specification relaxes that constraint — if ENCDNS_IP* attributes are supplied, responders may include INTERNAL_DNS_DOMAIN even without INTERNAL_IP*_DNS attributes.
The 'alpn' service parameter MAY not be required in contexts such as a variant of DNS over CoAP where messages are encrypted using OSCORE (RFC 8613), so the SHOULD requirement for including 'alpn' admits this exception.
For each ENCDNS_IP* attribute in a CFG_REPLY, the list of IP addresses MUST include at least one IP address. The service parameters SHOULD include at least the 'alpn' service parameter.
If the CFG_REQUEST includes multiple bitwise identical attributes, the responder SHOULD ignore all but the first occurrence. The responder MAY discard the full request if the count of repeated attributes exceeds an implementation-specific threshold.
If the computed SPKI digest for an ADN does not match the digest sent in ENCDNS_DIGEST_INFO, the client MUST treat the resolver certificate validation failure as a non-recoverable error.
If the IKEv2 responder used the NULL Authentication method (RFC 7619), the initiator MUST NOT use the returned ENCDNS_IP* resolver configuration unless the initiator is preconfigured (e.g., in the OS or application).
If the initiator receives both ENCDNS_IP* and INTERNAL_IP6_DNS (or INTERNAL_IP4_DNS) attributes, it is RECOMMENDED that the initiator use the encrypted DNS resolvers.
Implementations MUST support SHA2-256 (RFC 6234) for computing the SPKI hash of the encrypted DNS resolver certificate.
In CFG_REQUEST, ADN Length MUST be set to 0 in the ENCDNS_DIGEST_INFO attribute, and Num Hash Algs MUST be set to '(Length - 2)/2'. In CFG_REPLY or CFG_SET, Num Hash Algs MUST be set to 1.
Multiple ENCDNS_IP* attribute instances returned in CFG_REPLY MUST be presented to a local DNS client following their service priority; a smaller service priority value indicates a higher preference.
The Num Addresses field MUST NOT be set to 0 if the Configuration payload has type CFG_REPLY or CFG_SET; at least one IP address must be included in the list of IP addresses returned by the responder.
The Service Priority field MUST NOT be set to 0, because AliasMode (Section 2.4.2 of RFC 9460) is not supported — such a mode would trigger additional Do53 queries while the data can be supplied directly in the IKE response.
When ENCDNS_DIGEST_INFO is present in a CFG_ACK payload, it MUST be returned with zero-length data.
As discussed in RFC 9076, the use of encrypted DNS does not reduce the data available at the DNS resolver itself. Privacy properties are inherited from the specific encrypted DNS protocol used (e.g., RFC 8484 Section 8 for DoH, RFC 9250 Section 7 for DoQ).
The Authentication Domain Name (ADN) field carries a fully qualified domain name of the encrypted DNS resolver in DNS presentation format using an IDNA A-label. The name MUST NOT contain any terminators (e.g., NULL, CR).
The Subject Public Key Info (SPKI) hash is the output of a cryptographic hash algorithm whose input is the DER-encoded ASN.1 representation of the SPKI from the encrypted DNS resolver's certificate. This is analogous to DANE certificate usage PKIX-EE(1) with selector SPKI(1) but without full PKIX validation.
The SvcParams field encodes service parameters using the wire format from RFC 9460 Section 2.2. The service parameters MUST NOT include 'ipv4hint' or 'ipv6hint' (superseded by included IP addresses) and apply to all IP addresses in the attribute.
Three new IKEv2 Configuration Payload Attribute Types are defined: ENCDNS_IP4 (type 27) for IPv4 encrypted DNS resolvers, ENCDNS_IP6 (type 28) for IPv6 encrypted DNS resolvers, and ENCDNS_DIGEST_INFO (type 29) for conveying a certificate digest to pin or request specific hash algorithms.
Three new entries are registered in the IANA 'IKEv2 Configuration Payload Attribute Types' registry: ENCDNS_IP4 (value 27, multivalued, length 0 or more), ENCDNS_IP6 (value 28, multivalued, length 0 or more), and ENCDNS_DIGEST_INFO (value 29, multivalued, length 0 or more).
Hosting encrypted DNS resolvers in a split-VPN configuration minimizes the attack vector from compromised network devices, which would otherwise be able to monitor or modify DNS traffic. This specification restricts access to DNS messages to only the parties that need to know.
This document does not alter the trust that the IKEv2 initiator has placed on DNS configuration provided by a responder, and does not extend the scope of accepting DNSSEC trust anchors beyond the usage guidelines in RFC 8598 Section 6.
ENCDNS_DIGEST_INFO in CFG_REPLY or CFG_SET carries: R, Attribute Type (29), Length, 1-octet Num Hash Algs (MUST be 1), 1-octet ADN Length, optional Authentication Domain Name, 2-octet Hash Algorithm Identifier, and variable Certificate Digest (length = Length - 4 - ADN Length).
ENCDNS_DIGEST_INFO in CFG_REQUEST carries: 1-bit R, 15-bit Attribute Type (29), 2-octet Length set to '2 + (2 * number of hash algorithm identifiers)', 1-octet Num Hash Algs, 1-octet ADN Length (MUST be 0), and a list of 16-bit hash algorithm identifiers with no padding between them.
ENCDNS_IP4 and ENCDNS_IP6 attributes share a common format: 1-bit R (reserved), 15-bit Attribute Type, 2-octet Length, 2-octet Service Priority, 1-octet Num Addresses, 1-octet ADN Length, variable IP Address(es) (4 octets each for IPv4, 16 for IPv6), variable Authentication Domain Name, and variable SvcParams.