Re: [dnsext] Clarifying the mandatory algorithm rules

[Mark Andrews <[e-mail]>]

The intent of this section was to prevent downgrade to insecure due
to a attacker dropping RRSIGS.  DNSSEC has always been "if *any*
signature validates then the RRset validates".  There is no concept
of a "more secure algorithm" in DNSSEC.  There may be outside of
DNSSEC but not inside.

If the archives were online you could see that this was the intent
of this paragraph.

When a operator of a zone publishes DS (or trust-anchors) for a
zone with a algorithm that is a claim that the entire zone is signed
with that algorithm.  That claim will continue to hold for the life
of the DS records or until the operator can be assured that the
trust anchors have been removed for the algorithm, whichever is
longer.

Additionally the MUST is a directive to *zone operators*.  A zone
operator can comply with that MUST but validation will still fail
with unbound as unbound requires that a zone be signed with DNSKEYs
which are NOT in the zone prior to adding the DNSKEY to the zone
due to caching.  On this alone it is clear that unbound is in the
wrong.

If you want to do downgrade protection between algorithms one can
but only for the algorithms listed in the DS / trust-anchors.  They
are the only algorithms that the zone operator has made any claims
of existance for.

I think the paragraph in question should be relaxed to make to MUST
only apply to algorithms listed in the DS / published trust anchors.
This will allow for gradual introduction of RRSIG for new algorithms.
The current wording prevents this and is a real pain for large
zones.

It will also resolve this issue as now it is the sum of the algorithms
listed in DS (trust-anchors) + DNSKEY.

Mark

P.S. we need a better way to publish trust anchors in-band with
lifetimes etc. so that one can be assured that trust anchors expire
like DS and zones expire but that should be a different discussion.
RFC 5011 really isn't good enough.

-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: [phone]                 INTERNET: [e-mail]