Re: [DNSOP] [Ext] Re: Resolver behaviour with multiple trust anchors

[Petr Špaček <[e-mail]>]

On 6.11.2017 16:15, Paul Hoffman wrote:
> Doesn't "I don't trust my parent's security policy" open up a million
> cans of worms anyway? It feels like making this change to the default

1. The problem is that there were (and certainly will be) successfull
hacks into registries, that seems just inevitable.

2. Vast majority of people will not bother with setting up own trust
anchors. I.e. vast majority of people will not be affected by any
brittlenes you envision.

3. The small fraction of people who configure their own TA do it for a
reason. The reason I can see is "TA pinning". This provides users
ability to to configure their critical systems in a way which turns
successfull hack into my parent registry into Bogus status.

Yes, it requires them to keep TA up-to-date, but that is the price you
pay for pinning.

> behavior will make validation more brittle (because people *will* forget
> to update their lower-level trust anchors) in order to help a very small
> number of people who could have made the configuration change themselves.

Personally I do not see justification for 'trust DS or TA' behavior so
I'm not willing to make security critical code paths more complex just
for sake of having an unused configuration knob.

In other words, "could have made the configuration change themselves" is
not applicable here because the knob is not going to be available.

I did my best to explain my reasoning, let me know if you can see some
holes in the reasoning.

-- 
Petr Špaček  @  CZ.NIC