Re: [dnsext] DNSSEC, robustness, and several DS records

[Matt McCutchen <[e-mail]>]

On Wed, 2011-05-11 at 19:21 -0700, Doug Barton wrote:
> On 05/11/2011 18:58, Mark Andrews wrote:
> > The senario is that you have broken SHA-1 and can construct a working
> > DNSKEY which matches what the parent is publishing but have not
> > broken SHA-256.  If you trust SHA-1 then the attack works.  It you
> > don't trust SHA-1 the attack fails.  The rfc is assuming this will
> > happen before the reverse and is telling implementors to code for
> > it as if it was a current threat.
> 
> I get that, but I think we differ on the issue of "present." If there is 
> a _working_ SHA-256 DS I agree with you completely.

If there is a working SHA-256 DS there is no issue.  The question is
what the resolver should do if it gets a DNSKEY that matches a SHA-1 DS
but doesn't match any SHA-256 DS.  It has no way to distinguish a
mistake in the SHA-256 DS data in the original zone from a downgrade
attack.

-- 
Matt