IETF Logo Mail Archive

[DNSOP] Re: Collision Free Key Tags for DNSSEC draft

Mark Andrews <marka@isc.org> Thu, 10 July 2025 03:04 UTC

Return-Path: <marka@isc.org>
X-Original-To: dnsop@mail2.ietf.org
Delivered-To: dnsop@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 863E94236045 for <dnsop@mail2.ietf.org>; Wed, 9 Jul 2025 20:04:25 -0700 (PDT)
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -4.167
X-Spam-Level:
X-Spam-Status: No, score=-4.167 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=0.001, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.232, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (1024-bit key) header.d=isc.org header.b="mY0+PrTE"; dkim=pass (1024-bit key) header.d=isc.org header.b="JkQ+k4/V"
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LqolzM3FqwDD for <dnsop@mail2.ietf.org>; Wed, 9 Jul 2025 20:04:23 -0700 (PDT)
Received: from mx.pao1.isc.org (mx.pao1.isc.org [149.20.2.50]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id 73125423600D for <dnsop@ietf.org>; Wed, 9 Jul 2025 20:04:23 -0700 (PDT)
Received: from zimbra10.isc.org (zimbra10.isc.org [149.20.2.90]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mx.pao1.isc.org (Postfix) with ESMTPS id D14C63AB3C9; Thu, 10 Jul 2025 03:04:21 +0000 (UTC)
ARC-Filter: OpenARC Filter v1.0.0 mx.pao1.isc.org D14C63AB3C9
Authentication-Results: mx.pao1.isc.org; arc=none smtp.remote-ip=149.20.2.90
ARC-Seal: i=1; a=rsa-sha256; d=isc.org; s=ostpay; t=1752116661; cv=none; b=n/CCaVKukYAZN9EVwDKd0SlRmE0b1k1x5KOGXjUt/ltVxfEOhQP0Z7RjNUFFcecYuhgahq6sEDED3KpDvSCi6YaEQCzJ8fyKxHdfsVkrM16LWPgi6cez29f5hvbeHVOSsSYpDur57I6EDVBGfCSANYYDmxTQcVFO/4QrT9C53J8=
ARC-Message-Signature: i=1; a=rsa-sha256; d=isc.org; s=ostpay; t=1752116661; c=relaxed/relaxed; bh=7O+SbedrkHkMsJxjIXnD1O8tfjrBDlHpYnFLmBsmE5A=; h=DKIM-Signature:DKIM-Signature:Mime-Version:Subject:From:Date: Message-Id:To; b=KnihT63f6TRDmrxLYQIbwzl9TxxIThMZM9tk781mr2YzaSuRfuaMNrKecJLFNf878xR6Y3tRjEApcbSaM4dUl6WDpjH60jdxWDAUPL40C6SvQF8eacEI+gMW8Ts87cRmW7IY+9myqhfkl2b1SK8GFx2REhwCk0DsqUFw6hXxj5M=
ARC-Authentication-Results: i=1; mx.pao1.isc.org
DKIM-Filter: OpenDKIM Filter v2.10.3 mx.pao1.isc.org D14C63AB3C9
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=isc.org; s=ostpay; t=1752116661; bh=qDQYM/OcDPGaB37UbYQv8CiSIa8mI9A59Wp7iF4I9GQ=; h=Subject:From:In-Reply-To:Date:Cc:References:To; b=mY0+PrTErk59pTTBMfuPAAliBEWlMnGB1UhvUXErtr8WhxaAgeIMPpRVTs6NLMLUg gU5pXTC7YQ0sY59wObJ+yW19IXI1Q1oHyIrt7LjqkmfTNx0FkpOC/zkRbpcnXPbNTP TW5WjD35laXj8dt4a8tUu/s9zi2FwJ+bXMe9Wi9g=
Received: from zimbra10.isc.org (localhost [127.0.0.1]) by zimbra10.isc.org (Postfix) with ESMTPS id CC0CA2E6013F; Thu, 10 Jul 2025 03:04:21 +0000 (UTC)
Received: from zimbra10.isc.org (localhost [127.0.0.1]) by zimbra10.isc.org (Postfix) with ESMTPS id BCCB12E60141; Thu, 10 Jul 2025 03:04:21 +0000 (UTC)
DKIM-Filter: OpenDKIM Filter v2.10.3 zimbra10.isc.org BCCB12E60141
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=isc.org; s=05DFB016-56A2-11EB-AEC0-15368D323330; t=1752116661; bh=7O+SbedrkHkMsJxjIXnD1O8tfjrBDlHpYnFLmBsmE5A=; h=Mime-Version:From:Date:Message-Id:To; b=JkQ+k4/VvrSCPYYbDWL3vZl7OF1DUN1c5iSNALdFf+ta0ol4m39BPKiIX2x2BkVrz bEIvvJF/2cR/EMJZUOO+Mcvcgyzj23xq0bwmnlNvCWEAb0GAwR11UrmnJ0Bv0s+zN9 jy8lS9DjkTnAWO1qstxeUQc1XawiIi387LZrTIbw=
Received: from smtpclient.apple (n49-187-18-238.bla1.nsw.optusnet.com.au [49.187.18.238]) by zimbra10.isc.org (Postfix) with ESMTPSA id 5DCA72E6013F; Thu, 10 Jul 2025 03:04:20 +0000 (UTC)
Content-Type: text/plain; charset="utf-8"
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3731.700.6.1.11\))
From: Mark Andrews <marka@isc.org>
In-Reply-To: <df780b25-d30b-4927-9c09-3b531d185ab9@desec.io>
Date: Thu, 10 Jul 2025 13:04:07 +1000
Content-Transfer-Encoding: quoted-printable
Message-Id: <CACD8330-F54E-4CF1-908C-EA702CB450F8@isc.org>
References: <0c4715d1-cd1b-4726-a372-6ac3c26af786@nic.cz> <45260BA6-B4C0-4A2C-8E69-51D72C833C1F@nohats.ca> <b5674176-304a-e96e-22d4-d2a3818a1195@taugh.com> <a6aed8f2-51c7-4662-be8c-a5ff6ac8f5a1@nlnetlabs.nl> <20250708154239.DCDCCD25776F@ary.qy> <80901863-ec1a-4723-9169-78e28f504dd6@isc.org> <20250709021141.0FED8D268E7A@ary.qy> <eec6337c-9a10-497d-9dc2-ea6d1d66257a@isc.org> <e9d96900-1136-1fc1-9d72-1715421cfa8f@taugh.com> <1422A65D-7BA0-4638-9332-32B792B15E4B@rfc1035.com> <20b9ba28-cf32-4ca7-86d8-0de44662ab2b@isc.org> <D9F87870-CAFE-4411-8C5D-CFCFB0C9AE4D@rfc1035.com> <df780b25-d30b-4927-9c09-3b531d185ab9@desec.io>
To: Peter Thomassen <peter=40desec.io@dmarc.ietf.org>
X-Mailer: Apple Mail (2.3731.700.6.1.11)
Message-ID-Hash: QGJDFRZDUL2BBLW6WFALVRUPGE3FQNCI
X-Message-ID-Hash: QGJDFRZDUL2BBLW6WFALVRUPGE3FQNCI
X-MailFrom: marka@isc.org
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-dnsop.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: dnsop@ietf.org
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [DNSOP] Re: Collision Free Key Tags for DNSSEC draft
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/8bf3De0BtcJK3BcgkHsEvabaANM>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Owner: <mailto:dnsop-owner@ietf.org>
List-Post: <mailto:dnsop@ietf.org>
List-Subscribe: <mailto:dnsop-join@ietf.org>
List-Unsubscribe: <mailto:dnsop-leave@ietf.org>


> On 10 Jul 2025, at 06:01, Peter Thomassen <peter=40desec.io@dmarc.ietf.org> wrote:
> 
> 
> 
> On 7/9/25 20:09, Jim Reid wrote:
>>> Can you clarify source of your confidence about this 'not causing issues'?
>> Mental arithmetic. There are 2^16 possible key tags => there's a one in 2^15 chance a new tag clashes with an existing one.
> 
> Uniformity of the keytag distribution is a wrong assumption, see https://ripe78.ripe.net/presentations/5-20190520-RIPE-78-DNS-wg-Keytags.pdf
> 
> This deck also has some slides on impact.

So just use a method that will work reasonable well with the generated key tags.

For two signers A uses 'tag < 32768' and B uses 'tag >= 32768’ as part of the acceptance criteria
when generating a new tag.

Resolvers already do the bulk of the work with DNSSEC.  A few more key generation attempts on the
authoritative side won’t hurt anything.


> Have fun,
> Peter
> 
> _______________________________________________
> DNSOP mailing list -- dnsop@ietf.org
> To unsubscribe send an email to dnsop-leave@ietf.org

-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742              INTERNET: marka@isc.org

v2.46.0 | Report a Bug | By Email | System Status