IETF Logo Mail Archive

Re: [DNSOP] signalling mandatory DNSSEC in the parent zone

Mark Andrews <marka@isc.org> Mon, 01 March 2021 19:58 UTC

Return-Path: <marka@isc.org>
X-Original-To: dnsop@ietfa.amsl.com
Delivered-To: dnsop@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2FFF43A2216 for <dnsop@ietfa.amsl.com>; Mon, 1 Mar 2021 11:58:56 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.119
X-Spam-Level:
X-Spam-Status: No, score=-2.119 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=isc.org header.b=TJ+RLf9G; dkim=pass (1024-bit key) header.d=isc.org header.b=AbK+hB7R
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id h07AfYGVplDO for <dnsop@ietfa.amsl.com>; Mon, 1 Mar 2021 11:58:54 -0800 (PST)
Received: from mx.pao1.isc.org (mx.pao1.isc.org [149.20.64.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D28AB3A2215 for <dnsop@ietf.org>; Mon, 1 Mar 2021 11:58:54 -0800 (PST)
Received: from zmx1.isc.org (zmx1.isc.org [149.20.0.20]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx.pao1.isc.org (Postfix) with ESMTPS id 433E73AB01F; Mon, 1 Mar 2021 19:58:54 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=isc.org; s=ostpay; t=1614628734; bh=W2RjSTtwF0vHU/jmfidE9I8fxkYiZecyew7udm3SIuE=; h=From:Subject:Date:References:Cc:In-Reply-To:To; b=TJ+RLf9G4H5/Kwo+Rv3wVpe8AtmvZF8qCdveNqI1ZVPfgKtlMn+5u3YC+xuWLbpPV 0laOSaTqYeP5Wu7ptf2qwRPqEMok7aLP6sdj0UqIcLVmRfZpqvvK3Iazgh02W0Allq 6binEcYQWZrcgOqAhJIVBs7Dej/qIJrFMeD57jUc=
Received: from zmx1.isc.org (localhost [127.0.0.1]) by zmx1.isc.org (Postfix) with ESMTPS id 359E9160044; Mon, 1 Mar 2021 19:58:54 +0000 (UTC)
Received: from localhost (localhost [127.0.0.1]) by zmx1.isc.org (Postfix) with ESMTP id 172F9160089; Mon, 1 Mar 2021 19:58:54 +0000 (UTC)
DKIM-Filter: OpenDKIM Filter v2.9.2 zmx1.isc.org 172F9160089
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=isc.org; s=05DFB016-56A2-11EB-AEC0-15368D323330; t=1614628734; bh=pnxmnTsBd7whxdTqKGEOUPFYxPcaeBKSwyWe1Ccwzfo=; h=Content-Type:Content-Transfer-Encoding:From:Mime-Version:Subject: Date:Message-Id:To; b=AbK+hB7RCaSc5lzv9wOg9IU6R8Q3Vw8Fv8T+Ok/gFCiTdb0wX30fmq8fWxOxXX7fI RCIiPa9izIvqgkaeiekQJI+dQivRKJRiGUIgOf3llRTpIZqNKGq8XlkpK242DlPf90 LVz4Vm2kA5B+ed2m9EqU2eQts99yrXpfrF+QzMT4=
Received: from zmx1.isc.org ([127.0.0.1]) by localhost (zmx1.isc.org [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id Dnb--u6d9JLV; Mon, 1 Mar 2021 19:58:54 +0000 (UTC)
Received: from [172.30.42.83] (n114-75-173-184.bla4.nsw.optusnet.com.au [114.75.173.184]) by zmx1.isc.org (Postfix) with ESMTPSA id C5FF3160044; Mon, 1 Mar 2021 19:58:53 +0000 (UTC)
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
From: Mark Andrews <marka@isc.org>
Mime-Version: 1.0 (1.0)
Date: Tue, 02 Mar 2021 06:58:50 +1100
Message-Id: <DE24E067-C0D3-4E26-B7FB-EF8311AE5E0A@isc.org>
References: <20210301.205459.413147497474184552.he@uninett.no>
Cc: brian.peter.dickson@gmail.com, ulrich=40wisser.se@dmarc.ietf.org, dnsop@ietf.org
In-Reply-To: <20210301.205459.413147497474184552.he@uninett.no>
To: Havard Eidnes <he=40uninett.no@dmarc.ietf.org>
X-Mailer: iPhone Mail (18D52)
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/3KylQ-TrPYDqqTZUdXHn11A3hzI>
Subject: Re: [DNSOP] signalling mandatory DNSSEC in the parent zone
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop/>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 01 Mar 2021 19:58:56 -0000

Throw a forced algorithm change in on top where neither provider is willing to sign with the other providers algorithm. 

-- 
Mark Andrews

> On 2 Mar 2021, at 06:55, Havard Eidnes <he=40uninett.no@dmarc.ietf.org> wrote:
> 
> 
>> 
>>   - Switching providers while staying secure requires
>>   inter-provider cooperation, including publishing ZSKs from
>>   both providers in the DNSKEY RRSET served by both providers.
> 
> What?
> 
> Maybe I just don't understand the context or conditions here, but
> ...
> 
> Isn't it possible to stand up a new signing and publishing setup
> with new ZSKs and new KSKs, and have both the old DS record
> pointing to the old setup's KSK and a new DS record pointing to
> the KSK of the new setup registered in the parent zone, and then
> change the actual delegation (NS records), while still retaining
> both the two DS records for a while until the data from the old
> setup has timed out?
> 
> There is then no need to share the secret part of the KSKs or the
> ZSKs between the old and the new providers, or to include both
> the new and the old ZSKs in the zone.
> 
> Regards,
> 
> - Håvard
> 
> _______________________________________________
> DNSOP mailing list
> DNSOP@ietf.org
> https://www.ietf.org/mailman/listinfo/dnsop

v2.23.0 | Report a Bug | By Email