Re: [dnsext] Clarifying the mandatory algorithm rules

[Edward Lewis <[e-mail]>]

At 16:19 +0100 12/9/10, Matthijs Mekking wrote:

>Because the zone operator specifically wants to be protected against
>algorithm compromises and does that by listing more than one algorithm
>in the DS RRset.

DNSSEC is not designed to protect the zone operator, it is designed 
to protect the relying party.  Listing more than one algorithm is 
done to reach a wider audience, it does not enhance the security as 
far as the zone operator is concerned.

In the experimentation period before the first RFCs were produced 
(RFC 2052 being the first milestone) we played with the notion of key 
strengths.  (Keys, not algorithms because back then we only had the 
unencumbered DSA and the copyrighted RSA available.)  Trying to 
enhance the concept of DNSSEC by using the notion that one algorithm 
is better or one key is better than another failed time and time 
again.  When there's a weak link involved you can't overcome it.

What if your zone is signed with algorithm 42?  You might be more 
strongly signed than anyone else.  But what if you are delegated from 
a parent using RSA/MD5?  Your strengths are negated and if algorithm 
42 is not widely deployed you are even seen as unsigned to the masses.

So, so what if I say DNSSEC is not there to protect the zone 
operator.  Why does that mean that MUST is wrong?  The rationale is 
that no matter what you do, local policy is going to be followed. 
Local policy is going to prefer quick resolution of the query. 
Requiring DNSSEC to do extra or extraneous work is not constructive - 
by that I mean, once you've gotten a chain of trust why keep trying 
to find faults?  DNSSEC is not designed to be the last line of 
defense.

DNSSEC is never going to overcome weaknesses in the underlying 
cryptography.  Trying to do so is a futile quest and the relying 
party suffers.

-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis
NeuStar                    You can leave a voice message at [phone]

Ever get the feeling that someday if you google for your own life story,
you'll find that someone has already written it and it's on sale at Amazon?