Re: [dd] DS-pinning and Alias mode limitation

[Ben Schwartz <[e-mail]>]

Yes.  The DELEG DNSSEC pre-00 draft [1] says: "When computing the digest, the DNSKEY Owner Name is always set to "." (i.e., the root), because this DS record approves the use of the specified DNSKEY on any zone that is delegated to this endpoint.".

--Ben

[1] https://github.com/fl1ger/deleg/blob/main/draft-dnsop-deleg-dnssec.md
________________________________
From: dd <[e-mail]> on behalf of Roy Arends <[e-mail]>
Sent: Saturday, February 10, 2024 7:33 PM
To: [e-mail] <[e-mail]>
Subject: [dd] DS-pinning and Alias mode limitation

!-------------------------------------------------------------------|
  This Message Is From an External Sender

|-------------------------------------------------------------------!

I understand that DS pinning involves DS material that references a DNSKEY, uniquely tied to a {zone-name-server} pair.

It's important to note that the digest in a DS record is generated based on the DNSKEY owner name and DNSKEY RDATA.

DS pinning won't function properly in DELEG Alias Mode when the target serves multiple zones. For instance:

foo.example DELEG 0 generic.example.net
bar.example DELEG 0 generic.example.net
generic.example.net SVCB 1 …. ds=AABBCC ns=ns1example.net

In this scenario, there must either be a unique 1:1 pairing between the DELEG owner and target name (instead of N:1), or the requirement for the digest to contain the DNSKEY owner name must be eliminated for aliased pinned DS to work effectively.

Warmly,

Roy








--
dd mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/dd