Re: [DNSOP] how to delete obsolete DS for obsolete DNSKEY using CDS/CDNSKEY

Doug Barton <dougb@dougbarton.us> Fri, 07 February 2014 18:18 UTC

Return-Path: <dougb@dougbarton.us>
X-Original-To: dnsop@ietfa.amsl.com
Delivered-To: dnsop@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7B8C01ACCE4 for <dnsop@ietfa.amsl.com>; Fri, 7 Feb 2014 10:18:48 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.537
X-Spam-Level:
X-Spam-Status: No, score=-2.537 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RP_MATCHES_RCVD=-0.535, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JpbDOY3VZlOx for <dnsop@ietfa.amsl.com>; Fri, 7 Feb 2014 10:18:47 -0800 (PST)
Received: from dougbarton.us (dougbarton.us [208.79.90.218]) by ietfa.amsl.com (Postfix) with ESMTP id 30F671ACC80 for <dnsop@ietf.org>; Fri, 7 Feb 2014 10:18:47 -0800 (PST)
Received: from [192.168.0.20] (home [12.207.105.210]) by dougbarton.us (Postfix) with ESMTPSA id 18BF222B2A; Fri, 7 Feb 2014 18:18:47 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=dougbarton.us; s=dougbarton.us; t=1391797127; bh=ZalmjhdfPFmLRVV+M1TsX2YpliTfMqrfNbI1B1X5//8=; h=Date:From:To:CC:Subject:References:In-Reply-To; b=g/Jj00MjxDJGRNSpK3KLzcC7mZH93uE541jlgENxsVH0AdFkLvnDppgFsbaQKOadr 6YaWNLmyJJFkMsOy0RbcO3ovPS7V2+/cVVMUxTq1nqWaBcIUYDpaSosOIBfXvQsVqv 0bhDc7ssMl5UoCiSDnIEtpemDtly0I+I3IBt0SM4=
Message-ID: <52F52386.4070305@dougbarton.us>
Date: Fri, 07 Feb 2014 10:18:46 -0800
From: Doug Barton <dougb@dougbarton.us>
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Thunderbird/24.2.0
MIME-Version: 1.0
To: Warren Kumari <warren@kumari.net>
References: <CAJE_bqe95pn8rHvK3UffPDn+_rGYiq2G5sfdgqisH4JG7gFjBA@mail.gmail.com> <CAHw9_i+Jt4Ok+CddheGT_nA=e4srgbUSQy98GeQ9qGn_Cncjag@mail.gmail.com> <52F52215.9090709@dougbarton.us> <CAHw9_i+Aanz5NZVO5Q_x=1zyFzHZSmeU6yoLx3cDkwD2sC-XMA@mail.gmail.com>
In-Reply-To: <CAHw9_i+Aanz5NZVO5Q_x=1zyFzHZSmeU6yoLx3cDkwD2sC-XMA@mail.gmail.com>
X-Enigmail-Version: 1.6
OpenPGP: id=1A1ABC84
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Cc: dnsop <dnsop@ietf.org>
Subject: Re: [DNSOP] how to delete obsolete DS for obsolete DNSKEY using CDS/CDNSKEY
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/dnsop/>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 07 Feb 2014 18:18:48 -0000

On 02/07/2014 10:14 AM, Warren Kumari wrote:
> On Fri, Feb 7, 2014 at 1:12 PM, Doug Barton <dougb@dougbarton.us>; wrote:
>> On 02/06/2014 11:13 AM, Warren Kumari wrote:
>>>
>>> This means that you can use this to update / replace / remove existing
>>> DS records (if you have keys A, B, C and D and want to stop using C,
>>> you simply publish A, B, D), but you cannot remove*all*  DS records /
>>> go unsigned.
>>
>>
>> If we're willing to allow zones to go from unsigned to signed via CDS, why
>> not go from signed to unsigned? Both situations represent DOS vectors via
>> MITM.
>
> We are not allowing zones to go from unsigned to signed:

Right, and because it says not to do it in the RFC no one is going to do 
it? :)

Doug