Re: Interpreting DNSSEC was Re: [dnsext] flip-flopping secure and unsecure DNAME/CNAME

[Michael StJohns <[e-mail]>]

At 05:27 AM 10/23/2008, Edward Lewis wrote:
>At 20:54 -0400 10/22/08, Michael StJohns wrote:
>>After thinking about this topic for a while, I'm still bothered by the
>>inconsistency of treatment here.
>
>What inconsistency?

See my note to Ben.


>>But I think I have a possible mechanism - at least for DNAME.
>>
>>DNAME is the pretty much the equivalent of a delegation - only sideways.
>>Why not treat it like any other delegation?  In other words, in addition to
>>the records currently permitted at a DNAME node, add DS to the list.
>>This would require slightly overloading the meaning of DS, but in a way
>>that doesn't break the model too much.
>
>This makes as much sense as "matrix management."  DNAME isn't a delegation, it's a query restart.  What if the DNAME says there is a DS for the target but following the tree down to the target has no DNAME?

I'm not sure what you're getting at here.  DNAMEs point off tree.  So if I have

foo.example.com  DNAME otherexample.com
foo.example.com DS <ds data>
foo.example.com NSEC [DNAME, DS] <target>

otherexample.com  DNSKEY <data pointed to by the DS>
otherexample.com  <rest of the RRs>

DNAME says go look at another zone.
DS says here's how you bridge the trust.

If you're saying, what happens if you do a DNAME to a name subordinate to the DNAME - isn't that one of those illegal cases for DNAME?



>>This gets away from the problem where a resolver has one trust anchor, but
>>doesn't have a trust anchor for the target zone at the cost of requiring
>>some administration of the DS at the DNAME.
>
>This is not a problem.  If the target of the DNAME is not DNSSEC protected, it doesn't matter to the DNS.  

This is a problem.  DNAME publisher thought the target was protected, resolver didn't have trust anchors for it.  

>The application maybe, but what can it do?  If the target administrator has not signed the zone, then the application simply cannot validate the answer via DNSSEC.
>
>>another and UNKNOWN from a third if you can avoid it.  Chaining security back
>>to the original trust anchor and evaluating security in terms of data that
>>chains back ONLY to that trust anchor seems to be the most consistent approach.
>
>I think you are expecting too much from DNSSEC.
>
>Thinking about this scenario, if your application really needed security like this, why would there be the situation of secure DNAME insecure DNAME secure?  Although this flip-flop may happen, will it happen where it matters?  Is it realistic?  Or are we whacking with a sledgehammer at a shadow?

I used that one as an example to try and figure out what the output state was and got an answer from all of you that was inconsistent with the general contract.  In the case I'm proposing - once you went unsecure - as provide by the DS chain through the DNAME - then you'd stay unsecure, just like you do now with signed delegations into unsigned zones.


>-- 
>-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
>Edward Lewis                                                [phone]
>NeuStar
>
>Never confuse activity with progress.  Activity pays more.
>
>--
>to unsubscribe send a message to [e-mail] with
>the word 'unsubscribe' in a single line as the message text body.
>archive: <http://ops.ietf.org/lists/namedroppers/>



--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>