Re: [dd] [Ext] DS-pinning and Alias mode limitation

[Edward Lewis <[e-mail]>]

What if the domain name in the RRSIG resource record did not have to be the name of the zone the data belongs to?

Originally, and the reason why there is a domain name in the RRSIG resource record, is to allow any name to sign any piece of data.  "Any name" had to be put in the context of "any authorized name", which defaulted to be the zone's apex name for the data - where the DNSKEY resource record set resides now.  The problem was that indicating what names are authorized to authenticate data could not be done.  There were two different failed research attempts to come up with a way to indicate authority.

(For 'proof' of this wild claim: look back to " Domain Name System Security Extensions " (RFC 2535) and then "Domain Name System Security (DNSSEC) Signing Authority " (RFC 3008), noting the chronology more than the content.)

DELEG could do that.  By indicating the operator(s) for a zone, and recognizing that the operators have the private keys, then DELEG could indicate "all names in zone.example." are signed by "hoster2.example." and/or "hoster3.example." with the keys coming from the latter two apex names.  Just a possibility.

On 2/10/24, 19:34, "dd on behalf of Roy Arends" <[e-mail] on behalf of [e-mail]> wrote:

    I understand that DS pinning involves DS material that references a DNSKEY, uniquely tied to a {zone-name-server} pair.

    It's important to note that the digest in a DS record is generated based on the DNSKEY owner name and DNSKEY RDATA.

    DS pinning won't function properly in DELEG Alias Mode when the target serves multiple zones. For instance:

    foo.example DELEG 0 generic.example.net
    bar.example DELEG 0 generic.example.net
    generic.example.net SVCB 1 …. ds=AABBCC ns=ns1example.net

    In this scenario, there must either be a unique 1:1 pairing between the DELEG owner and target name (instead of N:1), or the requirement for the digest to contain the DNSKEY owner name must be eliminated for aliased pinned DS to work effectively.

    Warmly,

    Roy








    -- 
    dd mailing list
    [e-mail]
    https://urldefense.com/v3/__https://www.ietf.org/mailman/listinfo/dd__;!!PtGJab4!4bTjHGrk2MGbAPInPa5plRMC_wzw2wMErauPStuXw1ssFOTiD2cP7cA3L3e-P72VBO0QPfVDZeS13mZvQQ4$ [ietf[.]org]