Re: [dns-privacy] [Fwd: New Version Notification for draft-vandijk-dprive-ds-dot-signal-and-pin-00.txt]

[Peter van Dijk <[e-mail]>]

On Tue, 2020-05-26 at 09:40 -0400, Paul Wouters wrote:
> I thought my initial reading this was stored inside a DNSKEY was wrong
> and things are actually stored in a DS digest. And DS records do not
> have flags of the DNSKEY, so why are we talking again about DNSKEY
> flags?

When I ask my resolver for TXT validpin.dotpin.powerdns.club., the
following things happen in the resolver:

Queries are issued to root, TLD, etc., until the delegation to
validpin.dotpin.powerdns.club from dotpin.powerdns.club is received. It
looks like this:

validpin.dotpin.powerdns.club. NS	pdns-public-ns1.powerdns.com.
validpin.dotpin.powerdns.club. NS	pdns-public-ns2.powerdns.com.
validpin.dotpin.powerdns.club. DS	17418 225 2 ....
validpin.dotpin.powerdns.club. IN	RRSIG	DS ....

In this test deployment, we have chosen algorithm number 225 by fair
dice roll.

The resolver connects to a NS, let's say pdns-public-ns1.powerdns.com,
on port 853. During the handshake, the resolver receives the
SubjectPublicKeyInfo from the name server.

The resolver then constructs, in memory, a DNSKEY:

pdns-public-ns1.powerdns.com. DNSKEY 0 3 225 [base64-encoded SPKI]

The resolver then turns this into a DS with the normal procedure for
DNSKEYs (https://tools.ietf.org/html/rfc4034#section-5.1.4). This
yields a DS with some keytag, algo number 225, and digest type 2
(because that's what we saw in the DS set). The resolver checks if the
resulting DS is in the DS set given by the parent. If so, we are now
connected securely. If not, we disconnect and do not use this name
server.

> I dont know what you will use for keytag.

https://tools.ietf.org/html/rfc4034#appendix-B

>  The digest type would also be some strange number meaning
> "not really a DNSKEY digest".

The digest type is one of the types from 
https://www.iana.org/assignments/ds-rr-types/ds-rr-types.xhtml, just as
with normal DNSKEY processing.

> So why talk about DNSKEY flags? Where do these appear in the proposal?

The proposal currently has no need for any flags, so the flags field is
set to zero. If we come up with convincing reasons for flags, we could
define some.

> Why make life harder
> by needing to stuff square things into round boxes twice instead of
> once?

Because many registries only accept DNSKEY (via EPP or as CDNSKEY), and insist on doing the digesting into a DS on their end.

Kind regards,
-- 
Peter van Dijk
PowerDNS.COM BV - https://www.powerdns.com/