Re: [dnsext] DNSSEC, robustness, and several DS records

Doug Barton <dougb@dougbarton.us> Fri, 13 May 2011 02:25 UTC

Return-Path: <dougb@dougbarton.us>
X-Original-To: dnsext@ietfa.amsl.com
Delivered-To: dnsext@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 29897E065A for <dnsext@ietfa.amsl.com>; Thu, 12 May 2011 19:25:37 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.742
X-Spam-Level:
X-Spam-Status: No, score=-3.742 tagged_above=-999 required=5 tests=[AWL=-0.143, BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tS02PwwAlj8b for <dnsext@ietfa.amsl.com>; Thu, 12 May 2011 19:25:33 -0700 (PDT)
Received: from mail2.fluidhosting.com (mx22.fluidhosting.com [204.14.89.5]) by ietfa.amsl.com (Postfix) with ESMTP id D19C5E06FD for <dnsext@ietf.org>; Thu, 12 May 2011 19:25:32 -0700 (PDT)
Received: (qmail 4512 invoked by uid 399); 13 May 2011 02:25:28 -0000
Received: from unknown (HELO ?65.241.43.5?) (dougb@dougbarton.us@65.241.43.5) by mail2.fluidhosting.com with ESMTPAM; 13 May 2011 02:25:28 -0000
X-Originating-IP: 65.241.43.5
X-Sender: dougb@dougbarton.us
Message-ID: <4DCC9696.9060600@dougbarton.us>
Date: Thu, 12 May 2011 19:25:26 -0700
From: Doug Barton <dougb@dougbarton.us>
Organization: http://SupersetSolutions.com/
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.17) Gecko/20110414 Thunderbird/3.1.10
MIME-Version: 1.0
To: Matt McCutchen <matt@mattmccutchen.net>
References: <201105112250.p4BMoQZk020211@givry.fdupont.fr> <4DCB2E3F.4030701@dougbarton.us> <20110512015806.209E0EAF182@drugs.dv.isc.org> <4DCB4421.5020306@dougbarton.us> <1305174244.2793.8.camel@localhost> <20110512075546.GA17883@nic.fr> <4DCB9855.7020805@nlnetlabs.nl> <alpine.LSU.2.00.1105121524400.19348@hermes-2.csi.cam.ac.uk> <4DCC2F7C.9020100@dougbarton.us> <1305251295.4426.17.camel@localhost>
In-Reply-To: <1305251295.4426.17.camel@localhost>
X-Enigmail-Version: 1.1.1
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Cc: dnsext@ietf.org
Subject: Re: [dnsext] DNSSEC, robustness, and several DS records
X-BeenThere: dnsext@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: DNS Extensions working group discussion list <dnsext.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsext>, <mailto:dnsext-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/dnsext>
List-Post: <mailto:dnsext@ietf.org>
List-Help: <mailto:dnsext-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsext>, <mailto:dnsext-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 13 May 2011 02:25:37 -0000

On 5/12/2011 6:48 PM, Matt McCutchen wrote:
> On Thu, 2011-05-12 at 12:05 -0700, Doug Barton wrote:
>> [...] So if both work,
>> sure, disregard SHA-1. Otherwise, go with what works.
>
> While you have defended your position amply, in your description you
> continue to gloss over the issue.  The resolver does not know whether
> the SHA-256 DS is "working" (it has no way to distinguish a
> "non-working" SHA-256 DS from malicious replacement of the DNSKEY), so
> what you literally stated above is unimplementable.  What I believe you
> are really proposing, to honor the SHA-1 DS if the SHA-256 DS does not
> match /for any reason/, is only as secure as the second preimage
> resistance of SHA-1.
>
> I just wanted to make sure this is clear in everyone's mind.

Thanks for clarifying that. I was (obviously foolishly) thinking that 
there was a way to distinguish the 2 cases. In that case ignore 
everything I said, it should fail in Stephane's case.


Sorry for wasting everyone's time,

Doug

-- 

	Nothin' ever doesn't change, but nothin' changes much.
			-- OK Go

	Breadth of IT experience, and depth of knowledge in the DNS.
	Yours for the right price.  :)  http://SupersetSolutions.com/