IETF Logo Mail Archive

Re: [dane] Draft for serializing DNSSEC chains

Phillip Hallam-Baker <hallam@gmail.com> Thu, 30 June 2011 15:31 UTC

Return-Path: <hallam@gmail.com>
X-Original-To: dane@ietfa.amsl.com
Delivered-To: dane@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C13F711E807E for <dane@ietfa.amsl.com>; Thu, 30 Jun 2011 08:31:24 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.552
X-Spam-Level:
X-Spam-Status: No, score=-3.552 tagged_above=-999 required=5 tests=[AWL=0.046, BAYES_00=-2.599, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qlF0x06lV5UD for <dane@ietfa.amsl.com>; Thu, 30 Jun 2011 08:31:24 -0700 (PDT)
Received: from mail-gy0-f172.google.com (mail-gy0-f172.google.com [209.85.160.172]) by ietfa.amsl.com (Postfix) with ESMTP id 9FC2F11E81EC for <dane@ietf.org>; Thu, 30 Jun 2011 08:31:10 -0700 (PDT)
Received: by gyd5 with SMTP id 5so809314gyd.31 for <dane@ietf.org>; Thu, 30 Jun 2011 08:31:10 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=oEPQALKrn3YQyr9COlNEfe+ZK/21PpYnVEbcQ8HZHSs=; b=sUvV+VSADph6yNC9k7IawfEoH3HCysFhGuzpT0dKotLmc8dXxdmaqKjGuxpFdiJ1Qp l3YDUyrnpRAIsxXDpBC0H4G+QYGpYY+IMfyHLJbGzjBRFrv8bbOxPhwcebuN94nzGCye IxG2JPbJDvBUA4moxWluEhQoy098sRFErYdfA=
MIME-Version: 1.0
Received: by 10.101.177.8 with SMTP id e8mr1984866anp.128.1309447869913; Thu, 30 Jun 2011 08:31:09 -0700 (PDT)
Received: by 10.100.144.16 with HTTP; Thu, 30 Jun 2011 08:31:09 -0700 (PDT)
In-Reply-To: <CA3205C1.CE0D%eosterweil@verisign.com>
References: <BANLkTinugTJB-xhSekN4jn6c9Bv7KcJEFsCa+ZxnwTBcydtXjQ@mail.gmail.com> <CA3205C1.CE0D%eosterweil@verisign.com>
Date: Thu, 30 Jun 2011 11:31:09 -0400
Message-ID: <BANLkTimUGtWp=sXCbC3HJ+t8FFaAP+0Q4g@mail.gmail.com>
From: Phillip Hallam-Baker <hallam@gmail.com>
To: "Osterweil, Eric" <eosterweil@verisign.com>
Content-Type: multipart/alternative; boundary="001636c92c6223588f04a6ef9706"
Cc: Adam Langley <agl@imperialviolet.org>, dane@ietf.org
Subject: Re: [dane] Draft for serializing DNSSEC chains
X-BeenThere: dane@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: DNS-based Authentication of Named Entities <dane.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dane>, <mailto:dane-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/dane>
List-Post: <mailto:dane@ietf.org>
List-Help: <mailto:dane-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dane>, <mailto:dane-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 30 Jun 2011 15:31:24 -0000

On Thu, Jun 30, 2011 at 10:51 AM, Osterweil, Eric
<eosterweil@verisign.com>wrote:

>
>
>
> On 6/28/11 2:22 PM, "Adam Langley" <agl@imperialviolet.org> wrote:
>
> > As promised. (This is also the format that Chrome is using for it's
> > DNSSEC stapled certificate support.)
> >
> > http://tools.ietf.org/html/draft-agl-dane-serializechain-00
>
>
> I think I may be missing something here, so can someone clarify the
> following for me: what happens if someone encodes the chain of trust in one
> of these certs, and then the zones in that chain change their keys
> (rollovers, revocations, etc.)?  Isn't encoding a dynamic chain of trust in
> a static cert a requirements mismatch?


I don't understand the problem here. The RSIG values have an absolute
validity interval (i.e. not relative)

This is a pickled RSIG chain from a specific point in time. It says nothing
about the validity of the chain at any other point in time.

Unless there is a major flaw in DNSSEC, I can't see where there would be an
issue here.
-- 
Website: http://hallambaker.com/

v2.23.0 | Report a Bug | By Email