Re: [dnsext] DNSSEC, robustness, and several DS records

[Phillip Hallam-Baker <[e-mail]>]

On Tue, May 17, 2011 at 1:38 PM, Tony Finch <[e-mail]> wrote:

> Phillip Hallam-Baker <[e-mail]> wrote:
> >
> > 1) No, it is not likely that we will have an issue with SHA-1 with
> respect
> > to DNSSEC. The reason for this is that DNSSEC is not used to provide
> > non-repudiation. Thus it is not necessary to be able to state today that
> we
> > are confident that SHA-1 will be acceptably secure in 20 years time.
> >
> > I have asked Adi Shamir about likely progress on SHA1 and I think we are
> > good wrt DNSSEC for at least ten years.
>
> A useful point, thanks.
>
> > 4) Since SHA3 is being worked on right now, it would seem to me that the
> > appropriate upgrade path for DNSSEC would be to ignore SHA2 and skip
> > straight from SHA1 to SHA3.
>
> SHA2 is already widely deployed in DNSSEC, e.g. in the root zone and
> many TLDs.
>
> > One of the biggest hassles in DNSSEC is that the RRSIG records cover
> > individual record sets of the same type rather than all the records at a
> > domain.
>
> Why is that a hassle? It seems like an advantage to me. In particular it
> makes it possible to sign a dynamic zone where there is no such thing as
> "all the records at a domain".
>

It means that a client will frequently need to verify multiple RRSigs for
the same zone.

Using Merkle trees the public key operation can be done one per zone and
leveraged over all the records.


For example, let us say that example.com has A, AAAA, TXT and MX present.

The signature is calculated as follows


<sig>  = DSA ( H (  H ( H(A) + H (AAAA)) + H ( H(TXT) + H (MX) ) ))

The RRSIG records would be

A:  SIG + [H (AAAA)]  + [H ( H(TXT) + H (MX) )] + '0'
AAAA: SIG + [H (A)]  + [H ( H(TXT) + H (MX) )] + '1'
TXT: SIG + [H ( H(A) + H (AAAA))] + [H (MX] + '2'
MX:  SIG + [H ( H(A) + H (AAAA)) ] + [H (TXT)] + '3'

Note that each RRSIG is 512 + 256 + 256 + 16 = 1040  bits/130  bytes long
plus  whatever packaging is needed.

When validating this type of RRSIG the validator would first check to see if
it already has a signature verification result cached for the SIG value. So
even if there were 4 RR types in a zone it would only perform one public key
operation.


-- 
Website: http://hallambaker.com/