Re: [dnsext] DNSSEC, robustness, and several DS records

[Paul Hoffman <[e-mail]>]

On May 11, 2011, at 1:01 AM, Stephane Bortzmeyer wrote:

> A recent incident lead me to re-study the question of "what a
> validating resolver must/should do when there are several DS and some
> are invalid in some way?" AFAIK (I would be glad to be corrected
> here), the best common practice is to be lax ("DNSSEC is hard enough,
> accept any DS"), following RFC 4035, section 2.4 and 5.3.1.
> 
> But it seems there is an "exception". RFC 4509, section 3, says that
> DS hashed with SHA-1 must be ignored when there is a DS for the same
> key hashed with SHA-2. This is to avoid downgrade attacks.
> 
> In the incident I was talking about, there were two DS for the same
> KSK key, one hashed with SHA-1 and one with SHA-256 and the second one
> was invalid, because of a bug (wrong Algorithm field). As a result,
> both BIND and Unbound, following RFC 4509, returned a SERVFAIL, while
> there was another and perfectly valid DS record.

Note that the text in RFC 4509 has a SHOULD, not a MUST. The fact that the BIND and Unbound people treat it as a MUST seems like a bug.

> I question this rule: SHA-1 (as it is used for DNSSEC) is not broken

Correct.

> and the risk of downgrade attacks is ridiculous when you compare, both
> to the other attacks on DNSSEC, and to the risk of creating an
> error.

Correct. 

> Isn't it a case of excess security, which will turn people away
> from DNSSEC (too much risk of breakage)?

No, because it adds no security, so it cannot be "excess security". It feels more like a case of a spec with a SHOULD that does not include guidance on when to consider an exception. If people here want to revise RFC 4509 to reflect security practices that balance risk from known attacks against cost to attackers, I would propose changing:

   Validator implementations SHOULD ignore DS RRs containing SHA-1
   digests if DS RRs with SHA-256 digests are present in the DS RRset.

to:

   If there is a known preimage attack on SHA-1 that reduces its
   effective strength to less than 128 bits,
   validator implementations SHOULD ignore DS RRs containing SHA-1
   digests if DS RRs with SHA-256 digests are present in the DS RRset.

--Paul Hoffman