Re: [dnsext] flip-flopping secure and unsecure DNAME/CNAME

[Michael StJohns <[e-mail]>]

At 08:16 AM 10/13/2008, Wouter Wijngaards wrote:
>-----BEGIN PGP SIGNED MESSAGE-----
>Hash: SHA1
>
>Hi Michael,
>
>I think it is much simpler than that. The application is interested in
>what is known with certainty.
>1. It is certain the data is valid (secure)
>2. It is certain that security checks failed (bogus)
>3. whatever (insecure).
>
>Thus, your numbers 1, 3, 5 are folded into insecure (or maybe more
>accurately, 'no security available').

This is why doing the bigger matrix and trying to do the decomposition into handling states is probably the right approach - your later email changes this based on further discussion but still doesn't quite get all the states covered.


>A mail application could deliver 1 and 3, but not 2(bogus).  Or it might
>examine the AD bit on replies and only deliver 1.
>
>When a DNAME or CNAME chain crosses a BOGUS entry, the DNAME or CNAME
>chain result is bogus. When a DNAME or CNAME chain has all items secure,
>the DNAME or CNAME chain result is secure.  All other cases are insecure
>(i.e. the chain has one insecure element and the other elements are
>insecure or secure).
>
>I do not think a 'must be secure' bit is needed.  Only when all items in
>the chain are secure is the result secure, and does the AD bit get set.

The AD bit gets set (or not) when you return data from a recursive nameserver, but that doesn't really describe how an application doing its own DNSSEC validation should handle this type of data.

It may be that your approach of if anything is bogus its all bogus, else if everything is secure its all secure, else its unsecure is correct.  BUT - this seems at odds with the general DNSSEC contract that says we don't transition to an unsecure state unless we do it securely.  If I'm the zone owner of the zone with the DNAME, and I'd doing a reference to another zone that - at the time I did the delegation - I knew to be secure, shouldn't I expect that DNSSEC should flag it if someone tries to resolve this and finds an unsecure zone?  Again if not, why not?  And why isn't this as much of a downgrade attack as all the other various schemes that have been described to me?

Mike



>Best regards,
>   Wouter
>
>Michael StJohns wrote:
>> At 01:36 AM 10/13/2008, Ben Laurie wrote:
>>> 1. RR exists and here it is.
>>> 2. RR does not exist.
>>> 3. Server not reachable (or otherwise broken).
>>>
>>> to
>>>
>>> 1. RR exists and here it is.
>>> 2. RR does not exist.
>>> 3. RR exists but is broken in some way.
>>> 4. Server not reachable (or otherwise broken).
>> 
>> I don't think its this simple... really.
>> 
>> Basic DNS has the 3 answers in your first group - although I'd categorize the last one as "I can't make any determination about whether or not the answer exists for any of a number of reasons" - what Marc describes as "indeterminate".
>> 
>> DNSSEC  add 4 (actually maybe even 5) security states that are somewhat orthogonal to the DNS states:
>> 
>> 1. Unknown - I've got no superior trust anchor so I can't make any definite statement about whether or not the answer is secure.
>> 2.  Secure - I've gotten a chain of signatures covering which allow me to determine the answer is securely valid.
>> 3.  Unsecure - I've gotten a chain of signature plus certain other data which tells me in a secure manner that I have no security information about the final answer.
>> 4.  Bogus - I've gotten all the information I've asked for from the system, but I was unable to prove the security - bad signatures, missing keys, etc.
>> 5.  Insecure transition from secure - I've got valid signatures as far as a CNAME or DNAME, but the CNAME or DNAME point into an area of the tree with Unknown trust.
>> 
>-----BEGIN PGP SIGNATURE-----
>Version: GnuPG v1.4.9 (GNU/Linux)
>
>iEYEARECAAYFAkjzPDQACgkQkDLqNwOhpPg4hgCfZJrXXhwSeXgeZiU9W4FZ5Wwi
>O84AoKnIBWKPbaVGzxeCueQWk5L0WslT
>=tjtc
>-----END PGP SIGNATURE-----



--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>