Re: [dnsext] DNSSEC, robustness, and several DS records

Regarding the RFC4509 discussion,

I don't see why anybody would like to upload both a SHA-1 and SHA-2 DS
to their parent. With AM, CAT, CH, CL, COM, CZ, DK, EDU, FI, FR, GR, LI,
LU, MUSEUM, NET, NL, PM, RE, SE, TF, UK, WF and YT using only the SHA-2
algorithm for their DS in the root zone. Additionally, ARPA, BE, BIZ,
CO, JP, MY, XN--0ZWM56D, XN--11B5BS3A9AJ6G, XN--80AKHBYKNJ4F,
XN--9T4B11YI5A, XN--DEBA0AD, XN--G6W251D, XN--HGBK6AJ7F53BBA,
XN--HLCJ6AYA9ESC7A, XN--JXALPDLP, XN--KGBECHTV, XN--ZCKZAH all requires
a resolver to understand SHA-2 to be able to understand the DNSKEY in
their zone anyway.

I think it is fair to say that the DNSSEC functionality of a resolver
without support for SHA-2 is highly limited. As such I don't believe
that there are that many of them out there. (Am I wrong?)

Do like .COM and Just don't upload the SHA-1 and you will never have
this problem. We can perhaps have a different requirement wording in any
future RFC that is introducing a new DS algorithm. But for SHA-1 vs.
SHA-2 in reality this is not an issue.

I'm noticing that FR currently only has a SHA-2 in the root zone. I
guess they came to the same conclusion.

/S
----------------------------------------------------------------------
Stephan Lagerholm
Senior DNS Architect, M.Sc. ,CISSP
Secure64 Software Corporation, www.secure64.com
Cell: 469-834-3940

>-----Original Message-----
>From: dnsext-bounces@ietf.org [mailto:dnsext-bounces@ietf.org] On
Behalf Of
>Mark Andrews
>Sent: Wednesday, May 11, 2011 8:29 PM
>To: Francis Dupont
>Cc: Paul Hoffman; dnsext@ietf.org
>Subject: Re: [dnsext] DNSSEC, robustness, and several DS records
>
>
>In message <201105112022.p4BKMHmp010275@givry.fdupont.fr>, Francis
Dupont
>writes:
>>  In your previous mail you wrote:
>>
>>    Note that the text in RFC 4509 has a SHOULD, not a MUST. The fact
>>    that the BIND and Unbound people treat it as a MUST seems like a
>>    bug.
>>
>> => I don't understand how the SHOULD can be interpreted in order to
>> avoid the "bug" (:-). Seriously you can disagree with RFC 4509
>> but not about the way it has to be implemented, i.e., your concern
>> is not about what it should be...
>>
>> Regards
>>
>> Francis.Dupont@fdupont.fr
>> _______________________________________________
>> dnsext mailing list
>> dnsext@ietf.org
>> https://www.ietf.org/mailman/listinfo/dnsext
>
>Agreed.  You are either configured to follow the SHOULD or not and
>the default is to fail.  Now not having a switch to turn it off
>means you don't have a work around once you discover that DS is
>wrong which requires contacting the administrators for the zone as
>they are the only ones that can tell you whether it is wrong or you
>are under attack.  You can make a educated guess without contacting
>the zone administrators.
>
>Mark
>--
>Mark Andrews, ISC
>1 Seymour St., Dundas Valley, NSW 2117, Australia
>PHONE: +61 2 9871 4742                 INTERNET: marka@isc.org
>_______________________________________________
>dnsext mailing list
>dnsext@ietf.org
>https://www.ietf.org/mailman/listinfo/dnsext