Re: [DNSOP] Validating responses when following unsigned CNAME chains...

[Shumon Huque <[e-mail]>]

On Thu, Apr 30, 2020 at 11:14 AM Ted Lemon <[e-mail]> wrote:

>
> To be clear, I think that if we’ve been asked to do DNSSEC, we should
> always validate what we can when the answer includes some data that is
> provably insecure and some data that is provably secure and can be
> validated. I just don’t think the specs explicitly say that, so I’m
> wondering if people agree with me on this.
>

Yes, I completely agree.

Whether or not the specs (clearly) state this is debatable. I quickly
scanned 4035 again, and I believe it is implied, from a combination of :

* Section 3.2.3 saying _all_ RRsets in the answer section, and relevant
RRsets in the authority section need to be authenticated before determining
whether AD=1 can be set, and the further statement that the resolver MUST
follow the procedure in Section 5 to determine whether the RRs are
authentic.

* Section 5 , which describes full chain DNSSEC authentication.

This implies to me that _any_ RRset that the validator is processing needs
to be subjected to the full DNSSEC validation algorithm to determine its
security state.

CNAME redirections aren't explicitly described, but are arguably covered by
the above. The only mention of the CNAME case, is the exception to 3.2.3
that allows unsigned CNAMEs to be included in the answer and assessed to be
authentic because they were provably synthesized by a signed DNAME.

Shumon.