Re: [dnsext] Clarifying the mandatory algorithm rules

Mark Andrews <marka@isc.org> Fri, 19 November 2010 13:16 UTC

Return-Path: <marka@isc.org>
X-Original-To: dnsext@core3.amsl.com
Delivered-To: dnsext@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id CA0C53A683F for <dnsext@core3.amsl.com>; Fri, 19 Nov 2010 05:16:01 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -0.932
X-Spam-Level:
X-Spam-Status: No, score=-0.932 tagged_above=-999 required=5 tests=[AWL=1.667, BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id t3A-4RIK6C0B for <dnsext@core3.amsl.com>; Fri, 19 Nov 2010 05:16:01 -0800 (PST)
Received: from mx.ams1.isc.org (mx.ams1.isc.org [IPv6:2001:500:60::65]) by core3.amsl.com (Postfix) with ESMTP id CD72A3A6837 for <dnsext@ietf.org>; Fri, 19 Nov 2010 05:16:00 -0800 (PST)
Received: from farside.isc.org (farside.isc.org [IPv6:2001:4f8:3:bb::5]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "farside.isc.org", Issuer "ISC CA" (verified OK)) by mx.ams1.isc.org (Postfix) with ESMTPS id CE4055F98E4; Fri, 19 Nov 2010 13:16:35 +0000 (UTC) (envelope-from marka@isc.org)
Received: from drugs.dv.isc.org (drugs.dv.isc.org [IPv6:2001:470:1f00:820:ea06:88ff:fef3:4f9c]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by farside.isc.org (Postfix) with ESMTP id EB745E605F; Fri, 19 Nov 2010 13:16:30 +0000 (UTC) (envelope-from marka@isc.org)
Received: from drugs.dv.isc.org (localhost [127.0.0.1]) by drugs.dv.isc.org (Postfix) with ESMTP id E8B616F8F8B; Sat, 20 Nov 2010 00:16:27 +1100 (EST)
To: Jelte Jansen <jelte@isc.org>
From: Mark Andrews <marka@isc.org>
References: <alpine.BSF.2.00.1011180553250.83352@fledge.watson.org> <4CE53927.9090203@isc.org> <4CE58E90.6030607@nic.cz> <AANLkTin2H7UkP7FVfz3GN74CKtqn2OKo7MmcKMGOkvNY@mail.gmail.com> <4CE59B3D.5020109@nic.cz> <20101119004134.993F26EB749@drugs.dv.isc.org><AANLkTi=Hp6s4xwLQGyWv3BNtvUf5-SDtgUzHbNKtfCV1@mail.gmail.com> <20101119060416.024456F87CD@drugs.dv.isc.org> <4CE629F1.2090907@isc.org>
In-reply-to: Your message of "Fri, 19 Nov 2010 08:40:33 BST." <4CE629F1.2090907@isc.org>
Date: Sat, 20 Nov 2010 00:16:27 +1100
Message-Id: <20101119131627.E8B616F8F8B@drugs.dv.isc.org>
Cc: dnsext@ietf.org
Subject: Re: [dnsext] Clarifying the mandatory algorithm rules
X-BeenThere: dnsext@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: DNS Extensions working group discussion list <dnsext.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/dnsext>, <mailto:dnsext-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/dnsext>
List-Post: <mailto:dnsext@ietf.org>
List-Help: <mailto:dnsext-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsext>, <mailto:dnsext-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 19 Nov 2010 13:16:01 -0000

In message <4CE629F1.2090907@isc.org>, Jelte Jansen writes:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> On 11/19/2010 07:04 AM, Mark Andrews wrote:
> >>
> >> Downgrade protection for algorithms is every bit as important as
> >> downgrade to insecure.
> >> Precisely because a broken algorithm *is* insecure, in fact.
> > 
> > If a algorithm is insecure then you should remove it from the list
> > of acceptable algorithms in you validator.  That way you get insecure
> > not trusted out of the validator.
> > 
> 
> If you do that, and the zone(s) do 'normal' pre-publish rollover from
> that broken algorithm to a not-yet-broken one, you'd get bogus, not
> insecure, during the roll
> 
> Jelte

No you don't.  Once a algorithm is marked as invalid the validator
behaves exactly as if the validator doesn't know about the algorithm.

During the pre-publish period there isn't a trust path into the zone with
a supported algorithm.
 
Mark
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: marka@isc.org