Re: Redux: Why I want to remove the null key (SIG)

[Edward Lewis <[e-mail]>]

At 9:39 AM -0400 6/14/00, Roy Arends wrote:
>As this child has a KEY, which is validated off-tree, a secure entrypoint
>is defined here (as explained in our remarks on the
>draft-ietf-dnsext-zone-status-01.txt). The resolver of interest for this
>secure branch has the Mars Certification Agency KEY pre-configured and
>knows that this is a secure entrypoint.  Therefore this secure resolver
>can positively validate the SIG(KEY) at the child.

This assumes that all of the resolvers-of-interest are so configured.  The
problem is that for all other resolvers, this is a misconfiguration.

>> This was legal under the policy in RFC 2535, section 6, but is not legal
>> given the updating draft.
>
>Which draft would this be ?
>  draft-ietf-dnsext-simple-secure-update-01.txt,
>  draft-ietf-dnsext-signing-auth-01.txt or
>  draft-ietf-dnsext-zone-status-01.txt.

#2 - signing-auth

>According to 2535 there MUST be a NULL key signed by the parent in this
>case. This is also needed to prevent denial of service for this
>child for security aware resolvers, that are not preconfigured with
>the Mars Certification Agency KEY and corresponding entry-points.
>Of course, for these resolvers, the child is seen as unsecured.
>
>IMHO this doesn't say anything about the NULL key being a bad idea.

The "bad idea" is that although the parent has properly issued a NULL key,
the NULL key is not available (hidden).  OTOH, if the indication were in
the NXT record (current proposal is using the OPT record bit - we'll argue
that later), then the parent can still signal that it thinks the child is
unsecured.

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                                NAI Labs
Phone: [phone]                      Email: [e-mail]

"It takes years of training to know when to do nothing" - Dogbert

Opinions expressed are property of my evil twin, not my employer.




to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.