Re: [dnsext] Checking RRSIG RR validity

I agree the standard is not explicit here. These are my thoughts on this:

Checking Signer Name in RRSIG record

The standard is not very clear on how the Signer Name in an RRSIG record is checked. It simply says "The RRSIG RR's Signer's Name field MUST be the name of the zone that contains the RRset." ( RFC4035, section 5.3.1 )

Unfortunately a validating resolver does not know the zone in a secure way, so it's unclear how this is to be implemented.

Instead, the actual checks need to be:

(1) The Signers name must be equal to or a direct ancestor of the Owner of the RRSIG.

(2) If TypeCovered is DS, the Signers name must not be equal to the Owner of the RRSIG.

(3) The Signers name must not be above the Active trust anchor.

Optionally, for types that can only occur signed in the zone apex ( SOA, NS, DNSKEY, NSEC3PARAM ) an additional check that the Signers name is equal to the Owner of the RRSIG can be performed.

>From http://www.george-barwood.pwp.blueyonder.co.uk/DnsServer/NotesOnDNSSSEC.htm

Regards,
George
  ----- Original Message ----- 
  From: Sean Wells 
  To: dnsext@ietf.org 
  Sent: Friday, December 31, 2010 4:54 PM
  Subject: [dnsext] Checking RRSIG RR validity

  Hi,

  In section 5.3.1 of RFC 4035 :

  The RRSIG RR's Signer's Name field MUST be the name of the zone
  that contains the RRset.  The matching DNSKEY RR MUST be present in the zone's apex DNSKEY
  RRset, and MUST have the Zone Flag bit (DNSKEY RDATA Flag bit 7)
  set.My question is with respect to the first two MUSTs: "MUST be the name of the zone" and "MUST be present in the zone's apex DNSKEY RRset". What does a validating stub resolver (that uses recursive query mode) expected to do for implementing these two MUSTs ?
ThanksSean

------------------------------------------------------------------------------

  _______________________________________________
  dnsext mailing list
  dnsext@ietf.org
  https://www.ietf.org/mailman/listinfo/dnsext