Re: [dane] [Trans] CT for DNSSEC

Viktor Dukhovni <> Mon, 20 March 2017 23:01 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 80387127077; Mon, 20 Mar 2017 16:01:00 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.9
X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham autolearn_force=no
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id wXIy7ARaWSY9; Mon, 20 Mar 2017 16:00:58 -0700 (PDT)
Received: from ( []) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id A40F6126D85; Mon, 20 Mar 2017 16:00:58 -0700 (PDT)
Received: from [] ( []) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPSA id BD8047A32F1; Mon, 20 Mar 2017 23:00:57 +0000 (UTC) (envelope-from
Content-Type: text/plain; charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\))
From: Viktor Dukhovni <>
In-Reply-To: <>
Date: Mon, 20 Mar 2017 19:00:56 -0400
Cc: IETF DANE Mailinglist <>
Content-Transfer-Encoding: 7bit
Message-Id: <>
References: <> <> <> <> <> <>
X-Mailer: Apple Mail (2.3259)
Archived-At: <>
Subject: Re: [dane] [Trans] CT for DNSSEC
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: DNS-based Authentication of Named Entities <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Mon, 20 Mar 2017 23:01:00 -0000

> On Mar 20, 2017, at 6:43 PM, Wei Chuang <> wrote:
>>> No, this is because the parent can spoof any data for the child.
>>> It is unrelated to DNSSEC.
>> With qname minimization, the parent will first need to deny an NS
>> RRset for the child, and those DOE records are better candidates
>> for logging than routine non-NS queries.
> Can you expand on how the the DOE record (which I assumes means
> denial-of-existence) could work with an adversarial parent?

Yes, DOE is denial of existence.  When the child sends NS queries
as part of qname minimization a negative response (no NS records) 
will include signed NSEC(3) records to that effect, signed by the
parent zone.  These are candidates for logging.

An insecure positive response will include NSEC(3) records proving
the non-existence of the DS RRset (possibly via the opt-out flag).
These can also be logged.

A secure positive response, can also be logged, and the follow-up
query for any associated DS records will again either yields an
answer that can be logged, or DOE that can be logged.

The key question is how to avoid logging ridiculous volumes of
data that can DoS any log service and also disclose too much.

Hence the suggestion to consider using the PSL as a cut-off
mechanism.  One would also not log NXDOMAIN responses to NS,
which might allow parent domains to lie about non-existence,
but is surely necessary to guard against filling logs with

There are likely many issues this fails to consider, but I
think that's a reasonable starting point to explore further.