Re: DNSSEXT Yokohama Minutes

[Derek Atkins <[e-mail]>]

Edward Lewis <[e-mail]> writes:

> The issue here is that it is easy to spoof away the signed wildcard
> with opt-in.  Let's say I do ask for alpha3 A.  Since there's an
> opt-in-ized NXT saying that alpha3 is not explicitly signed in the
> zone, all an attacker needs to do is replay this before the answer
> with the signed * match returns - or - modify a cache to strip away
> the *-synthesized records from an answer.

As I said, an answer of NXDOMAIN is incomplete without _TWO_ signed
NXT records, so a client would know they were being attacked if they
only received one.  Similarly, an attacker could not add an 'A' record
to this response, because opt-in only allows unsecured delegations.

> So, if there is an applicable * - then it would hide all the unsecured
> matched "behind it" which is counter-intuitive to the algorithm in
> rfc1034/s4.3.3.

Right, but there _are_ no unsecured matches because opt-in only allows
unsecured NS, and you cannot have an NS wildcard.

> >What it DOES mean is that you need to send twice as much data to prove
> >an NXDOMAIN.  It is not sufficient to just show the NXT for the
> >request, but you must also show the NXT for the wildcard.
> 
> To match an opted-out name (unsecured) you have to prove it isn't
> secured, and that there isn't a potential wildcard, the latter may
> require multiple NXT's.

This is correct, but only in the case where you have a multi-layer
zone.

> Also - does the presence of an opted-out name impact the scope of a
> wildcard's matches?

It doesn't.  It is no worse than a non-opted-out name.

-derek
-- 
       Derek Atkins
       Computer and Internet Security Consultant
       [e-mail]             www.ihtfp.com

--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>