Re: [dnsext] Clarifying the mandatory algorithm rules

[Alfred Hönes <[e-mail]>]

In his longer message of Fri, 10 Dec 2010 08:59:54 -0500,
Olafur Gudmundsson said:

> [...]  For what it is worth paranoid is what security people are
> more comfortable [...]

... where "paranoid" indicates "validate every signature path
you find and only accept the end signature if they all verify".


I still believe that's a wrong perception, wrt verification of
signatures.

In X.509 / PKIX, a single, fully verified certificate chain
(from a trust anchor to the certificate under consideration)
suffices, as I already have recalled twice in this debate.
So all major "customers" of those certificates, in particular
TLS, certificate-based IKE/IPsec, and CMS / S/MIME are based on
this paradigm.  Please refer to RFC 5280 for the details.

I see no reason why DNSSEC validating resolvers should behave
more "paranoid" than TLS, IKE, and CMS/SMIME implementations do.

In PKIX, any certificate can be revoked by listing it in a CRL,
which needs being looked up in cert path validation for each cert.
The equivalent revocation operation in DNSSEC is withdrawing the DS;
as long as the signer maintains the DS, it considers the signatures
produced by the respective algorithm/key pair as valid and sufficient,
and hence the algorithm as "safe enough for this zone".

Kind regards,
  Alfred.