Re: [DNSOP] New Version Notification for draft-wessels-dns-zone-digest-01.txt

["Wessels, Duane" <[e-mail]>]

> On Jul 8, 2018, at 5:28 PM, Olafur Gudmundsson <[e-mail]> wrote:
> 
> 
> +1 
> I spent lots of time earlier this century along with Johan Ihren trying to figure out how to 
> secure the transfer of a particular zone (the root) to any resolver. 
> The only sane way is to not transfer the zone over AXFR as any intermediary can mess with the zone contents mostly in the case of “glue” records,
> thus transferring the zone over HTTPS or RSYNC with a PGP signature over the zone file is the only viable solution going forward. 

I respectfully disagree. 

I dislike PGP (and S/MIME) for a couple of reasons.  For one, I think it limits the use cases to non-AXFR.  You would have to either keep the original file in-tact (not just ordering, but character-per-character) if to be redistributed, or you would have to define a sorting for the data.  Any reformatting of the data (whitespace etc) invalidates it.  Additionally, you'd have to choose between detached signatures (which I think are a bad idea) or use a PGP attached signature format, in which case you are no longer distributing a file that could be directly loaded into a name server. 

Regarding HTTPS/RSYNC, that would be irrelevant.  If the data is secured then the transport doesn't matter at all.


>  
> 
> Historical background: SIG(AXFR) was rejected because it required putting the zone into canonical order and calculating the signature, 

Thanks for that.  This little tidbit was lost in the process of editing those RFCs.

> in the case of dynamic update this is a real expensive operation, thus we got rid of it.
> 

I agree that dynamic updates complicate zone digests.  It could be made to work without sorting the whole zone, but some sorting would be required.  But in general I don't think the complexity of digests for dynamic zones is worth it.  

DW