Re: [DNSOP] New Version Notification for draft-wessels-dns-zone-digest-01.txt

[Shumon Huque <[e-mail]>]

On Tue, Jun 19, 2018 at 10:32 AM Petr Špaček <[e-mail]> wrote:

>
> I think we need to first answer question why existing technologies do
> not fit the purpose.
>

This is a reasonable question.

I noticed that the draft doesn't mention SIG(0) at all. One of the main
motivators of the draft is stated to be secure, wide scale distribution of
the root zone. To me, SIG(0) would have been an obvious candidate solution
for this problem. The zone owner can publish one public key to the world,
and signs zone transfers messages with the corresponding secret key. If the
zone owner supports IXFR, the incremental cost of these message signatures
is also quite small.

Possible issues with SIG(0):

* Although it is an existing technology, it isn't widely implemented or
used. I just learned on DNS twitter that BIND only supports SIG(0) for
UPDATE for example, and not XFR.

* If the goal is to support secure acquisition of the zone outside the DNS
protocol, then it can't do that. But neither is ZONEMD needed for that - we
can use an out of band signature using a variety of methods.

* And there is also the question of the status of SIG(0) which isn't clear
to me: Although RFC 2931 is not obsolete, it is based on the SIG record,
which is defined in an RFC that has been obsoleted by the DNSSEC-bis
documents.

-- 
Shumon.