Re: [DNSOP] [Ext] Re: Configured Trust Anchor vs. DS record

[Paul Wouters <[e-mail]>]

On Wed, 15 Nov 2017, Frederico A C Neves wrote:

> Yes. And add to that cases were TLDs rolled just before adding to the
> root.

So what is the security model then?

Let's say .example rolled and now has a bad DS.

Someone overrides this with a local trust anchor so the domain does not
go dark.

- How do you know the roll was legitimate?
- How does an application make a security decision about a found TLSA
   record that depends on this trust anchor?

Now .example rolls to yet another key to fix their mistake and updates
the DS.

- How does the application know the roll is legitimate?
- How does an application make a security decision about a found TLSA
   record that depends on this trust anchor?
- Who, why and when does the local trust anchor get deleted. What if
   _this_ is the key that example.com lost the private key to?

Now same as above, but one of these rolls were done by an attacker and is
malicious.


Trusting "any"thing is just a path to madness.

Paul