Re: [dnsext] DS digest downgrade

[Wes Hardaker <[e-mail]>]

>>>>> On Mon, 21 Mar 2011 23:13:00 -0000, "George Barwood" <[e-mail]> said:

GB> I think that RFC 4509 could have pointed out the subtle implications
GB> for the uniform generation of DS records. There might be some risk
GB> that an administrator fails to publish a required DS record (
GB> possibly due to some parent constraint on the total size of the DS
GB> RRset ).

We deliberately stayed away from best-practices in the text because if
we went down that road it never would have been published :-/

You're right that this sort of discussion is needed somewhere, but as
others have pointed out there will/could be more and more algorthims for
more and more parts of the protocol and this situation (and transitions)
should be discussed in a single document, not in each individual one.
[though it would have been nice to refer to one]

What's worse, it takes careful coordination with your parent.

Consider the case where:

T+0: example.tld adds a new key
T+1: example.tld sends a SHA1 DS record to the parent
T+2: tld publishes the new DS
T+3: someone queries for the example.tld DS and gets a DS record set
     with the SHA1 DS for the new key.  And a TTL picked by ???
     [multiple options exist here].
T+4: example.tld sends a SHA256 DS record to the parent
T+5: tld publishes the new DS

If a parent only allows updating of a single DS record at a time, the
time between T+1 and T+5 could actually be on the order of seconds even,
but there is a time gap.  The whole process needs to document
parent/child relationships too, and the fact that the recommended
interface between the parent and child SHOULD accept multiple algorithms
simultaneously to prevent situations like the above.  So the advice to
the child gets even longer and more winded: if your parent only accepts
one record at a time, please publish the SHA256 first if you value
security.  Or SHA1 first if you value widest-interoperability (which I
actually doubt as I suspect everything? works with SHA256 now or won't
work at all in the first place, since SHA256 predates the NSEC3 records
which are now in such wide-spread use that you're chances of being
highly successful on the internet with SHA256 but no NSEC3 is unlikely).

As you can see...  it isn't a short bit of text that is needed.
-- 
Wes Hardaker
Cobham Analytic Solutions