Re: [dd] DS-pinning and Alias mode limitation

Hi Ben,

> On 12 Feb 2024, at 14:44, Ben Schwartz <bemasc@meta.com> wrote:
> 
> Yes.  The DELEG DNSSEC pre-00 draft [1] says: "When computing the digest, the DNSKEY Owner Name is always set to "." (i.e., the root), because this DS record approves the use of the specified DNSKEY on any zone that is delegated to this endpoint.".

Thanks for that. 

There needs to be a few words in the document, possibly the security section, on the impact on the security/threat model (if any) when there is no direct cryptographic binding between the parent and the secure entry point DNSKEY of the child zone. (i.e. the chain of trust is between parent (via DELEG) and child (KSK) via the root, and not directly).

Warmly,

Roy

> 
> --Ben
> 
> [1] https://github.com/fl1ger/deleg/blob/main/draft-dnsop-deleg-dnssec.mdFrom: dd <dd-bounces@ietf.org> on behalf of Roy Arends <roy@dnss.ec>
> Sent: Saturday, February 10, 2024 7:33 PM
> To: dd@ietf.org <dd@ietf.org>
> Subject: [dd] DS-pinning and Alias mode limitation
>  !-------------------------------------------------------------------|
>   This Message Is From an External Sender
> 
> |-------------------------------------------------------------------!
> 
> I understand that DS pinning involves DS material that references a DNSKEY, uniquely tied to a {zone-name-server} pair.
> 
> It's important to note that the digest in a DS record is generated based on the DNSKEY owner name and DNSKEY RDATA.
> 
> DS pinning won't function properly in DELEG Alias Mode when the target serves multiple zones. For instance:
> 
> foo.example DELEG 0 generic.example.net
> bar.example DELEG 0 generic.example.net
> generic.example.net SVCB 1 …. ds=AABBCC ns=ns1example.net
> 
> In this scenario, there must either be a unique 1:1 pairing between the DELEG owner and target name (instead of N:1), or the requirement for the digest to contain the DNSKEY owner name must be eliminated for aliased pinned DS to work effectively.
> 
> Warmly,
> 
> Roy
> 
> 
> 
> 
> 
> 
> 
> 
> -- 
> dd mailing list
> dd@ietf.org
> https://www.ietf.org/mailman/listinfo/dd