IETF Logo Mail Archive

[DNSOP] Re: Collision Free Key Tags for DNSSEC draft

Petr Špaček <pspacek@isc.org> Tue, 08 July 2025 16:28 UTC

Return-Path: <pspacek@isc.org>
X-Original-To: dnsop@mail2.ietf.org
Delivered-To: dnsop@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 327D6417B2FF for <dnsop@mail2.ietf.org>; Tue, 8 Jul 2025 09:28:01 -0700 (PDT)
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -4.168
X-Spam-Level:
X-Spam-Status: No, score=-4.168 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.232, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (1024-bit key) header.d=isc.org header.b="ZOilkqNy"; dkim=pass (1024-bit key) header.d=isc.org header.b="Il6kzUzs"
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Cx75ot01NaHL for <dnsop@mail2.ietf.org>; Tue, 8 Jul 2025 09:28:00 -0700 (PDT)
Received: from mx.pao1.isc.org (mx.pao1.isc.org [149.20.2.50]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id 1A925417B2F4 for <dnsop@ietf.org>; Tue, 8 Jul 2025 09:27:59 -0700 (PDT)
Received: from zimbra10.isc.org (zimbra10.isc.org [149.20.2.90]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mx.pao1.isc.org (Postfix) with ESMTPS id CCC593AB3B5 for <dnsop@ietf.org>; Tue, 08 Jul 2025 16:27:58 +0000 (UTC)
ARC-Filter: OpenARC Filter v1.0.0 mx.pao1.isc.org CCC593AB3B5
Authentication-Results: mx.pao1.isc.org; arc=none smtp.remote-ip=149.20.2.90
ARC-Seal: i=1; a=rsa-sha256; d=isc.org; s=ostpay; t=1751992078; cv=none; b=iamLFTG3ENCQpa7Ttkaq5YzWIw/PLUzrsZFhhugd/TnXSUozJi3a+NYki85YpCJe3FLlJyC9VrxtJqQVode0W4FYPcOo3LZyRsA5pqPgvHZeII0Auhu5ZjtWMrEzhwK+frW2Q8gUaCbTT1Az/6zQbzeAkmYDRCfAm0bar8t/fBc=
ARC-Message-Signature: i=1; a=rsa-sha256; d=isc.org; s=ostpay; t=1751992078; c=relaxed/relaxed; bh=c09sA0a4wGRgRF+F6VojYnte4QpX/RWcVo0dYCEDJAc=; h=DKIM-Signature:DKIM-Signature:Message-ID:Date:MIME-Version: Subject:To:From; b=PAcwL5XYKZRQ2C1rgJOKH6SsqNblmTINh1lZFabuzwI10Sl0stYOfpH+l63XseYtD1NJ1Jg2WmBxIfFDOpUp5aZaSIMRMcZQ7sw3LWDymJXh04U62MOtp0w9hTx+5arF+rTp/27qAI5mwaT5UGocAcXZTbBy+3C9dK8zmD9S8ZU=
ARC-Authentication-Results: i=1; mx.pao1.isc.org
DKIM-Filter: OpenDKIM Filter v2.10.3 mx.pao1.isc.org CCC593AB3B5
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=isc.org; s=ostpay; t=1751992078; bh=7F4gn1Q4Kb1cQKnrGucrTtOvO+yl03RvHsjpYWFbouU=; h=Date:Subject:To:References:From:In-Reply-To; b=ZOilkqNy1FfL/o54oU/qvfda4t14iOKiMTcyK0k0WVPva5LiGdCX3JQxwOCOhRIu0 mhZ0R95zxOESxzV/ss+IzjKx2GGCyFyZavyEMjEaEQOfCJGovYPfQFrt1scifgJAQj 156Pon11oDm8bl7z/td26F7tWGjqvVGuTmkUJKtk=
Received: from zimbra10.isc.org (localhost [127.0.0.1]) by zimbra10.isc.org (Postfix) with ESMTPS id C892E2E603A9 for <dnsop@ietf.org>; Tue, 8 Jul 2025 16:27:58 +0000 (UTC)
Received: from zimbra10.isc.org (localhost [127.0.0.1]) by zimbra10.isc.org (Postfix) with ESMTPS id C504B2E603AA for <dnsop@ietf.org>; Tue, 8 Jul 2025 16:27:58 +0000 (UTC)
DKIM-Filter: OpenDKIM Filter v2.10.3 zimbra10.isc.org C504B2E603AA
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=isc.org; s=05DFB016-56A2-11EB-AEC0-15368D323330; t=1751992078; bh=c09sA0a4wGRgRF+F6VojYnte4QpX/RWcVo0dYCEDJAc=; h=Message-ID:Date:MIME-Version:To:From; b=Il6kzUzsKz4P3tEyVo73mLfEsXBkZFcJJ94qa6Ghea3IYBupT9PG3WfUFImo5PU8/ AmXKqHLSBgru5R/CVIKd5x6vdYyU1SN6ylnDDQ+yfa/bFt5pvK9l8YbDDMT+lihGd5 zOECKz+Fzpk/osg8zmW2MLog4naLfDjk7L3s76sI=
Received: from [192.168.35.197] (ip-86-49-240-85.bb.vodafone.cz [86.49.240.85]) by zimbra10.isc.org (Postfix) with ESMTPSA id 61B5F2E603A9 for <dnsop@ietf.org>; Tue, 8 Jul 2025 16:27:58 +0000 (UTC)
Message-ID: <80901863-ec1a-4723-9169-78e28f504dd6@isc.org>
Date: Tue, 08 Jul 2025 18:27:54 +0200
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
To: dnsop@ietf.org
References: <0c4715d1-cd1b-4726-a372-6ac3c26af786@nic.cz> <45260BA6-B4C0-4A2C-8E69-51D72C833C1F@nohats.ca> <b5674176-304a-e96e-22d4-d2a3818a1195@taugh.com> <a6aed8f2-51c7-4662-be8c-a5ff6ac8f5a1@nlnetlabs.nl> <20250708154239.DCDCCD25776F@ary.qy>
Content-Language: en-US
From: Petr Špaček <pspacek@isc.org>
Autocrypt: addr=pspacek@isc.org; keydata= xsFNBF/OJ/4BEAC0jP/EShRZtcI9KmzVK4IoD/GEDtcaNEEQzPt05G8xtC0P4uteXUwW8jaB CdcKIKR4eUJw3wdXXScLNlyh0i+gm5mIvKPrBYNAMOGGnkbAmMQOt9Q+TyGeTSSGiAjfvd/N nYg7L/KjVbG0sp6pAWVORMpR0oChHflzKSjvJITCGdpwagxSffU2HeWrLN7ePES6gPbtZ8HY KHUqjWZQsXLkMFw4yj8ZXuGarLwdBMB7V/9YHVkatJPjTsP8ZE723rV18iLiMvBqh4XtReEP 0vGQgiHnLnKs+reDiFy0cSOG0lpUWVGI50znu/gBuZRtTAE0LfMa0oAYaq997Y4k+na6JvHK hhaZMy82cD4YUa/xNnUPMXJjkJOBV4ghz/58GiT32lj4rdccjQO4zlvtjltjp9MTOFbRNI+I FCf9bykANotR+2BzttYKuCcred+Q7+wSDp9FQDdpUOiGnzT8oQukOuqiEh3J8hinHPGhtovH V22D0cU6T/u9mzvYoULhExPvXZglCLEuM0dACtjVsoyDkFVnTTupaPVuORgoW7nyNl0wDrII ILBqUBwzCdhQpYnyARSjx0gWSG1AQBKkk5SHQBqi1RAYC38M59SkpH0IKj+SaZbUJnuqshXh UIbY1GMHbW/GDhz7pNQFFYm2S4OPUBcmh/0O0Osma151/HjF7wARAQABzR9QZXRyIMWgcGHE jWVrIDxwc3BhY2VrQGlzYy5vcmc+wsGXBBMBCABBAhsDBQsJCAcCBhUKCQgLAgQWAgMBAh4B AheAAhkBFiEEEVO2++xeDVoSYmDzq9WHzfBlga4FAmd7vqsFCQmG4S0ACgkQq9WHzfBlga5H dA//SNIJAXyYxpoIrQwtTSOded93J+CIYHd2ArxCsS+ZXzeaSkHcqp2QfneLY2yyiQwjeivu MfqEBIASNZ94T+4OjhEHAFaAUJQtYMY7qmH69Q5h1PQMk/HZX4QNEDB6dihjz4wunB2mRcac GnRziAQUAnlHSSZDU2EtTddmRYTCaeX9rU8O5ja0+qPBJket7PjS0yT8DQJF+aKRsQz17ywT 3rNR7NBgeKrkBud4/zE7VRoxSRCPkWkgixEog+AotZt22psgQTv+kWx89+7cTiFZaLMmtV6v Ws8QTpDRDM3hCJBCI6qk61k8SLuQ+5VuVWBM/ozoN1ON2J9anxVTrxhNsFM3RLHV/Qh9p/0y T4our7JxB6dsos3HtlRR2npXS1PMrrXt7ZnnfYao+9zbOrZHC7NRY3feaLhieLx1pKmdDRHT CAbqaGnqX22hYYemtYFzSAv7stCdqdncAEkZJy4HByjQwFVGn8A6rp7H1xV2LmlkNAMEoWrT GJ+wH8A+VA3qbZF9Ab8Ht2GRj3mQQ4h8NnRYjKyqecCQOI5Xmn4S61nQ9y+wOBUSTlAQ6a5n LmMpCVe2/D4pWFxpUxc1z8Hq+uEN95sPgbihiSdgBR50DRdqW57ulFHA9LKJ0AEnBtQfvVth qAkvG8iBYl+UpoX1xW+dbX2g6nI5Rbx8u+EojKXOwU0EX84n/gEQANARNXihDNc1fLNFZK5s O14Yg2TouK9eo9gGh4yLSrmZ3pjtnuJSpTWmGD4g0EYzhwWA/T+CqjUnrhsvzLQ1ECYVqLpM VqK2OJ9PhLRbx1ITd4SKO/0xvXFkUqDTIF6a5mUCXH5DzTQGSmJwcjoRv3ye+Z1lDzOKJ+Qr gDHM2WLGlSZAVGcUeD1S2Mp/FroNOjGzrFXsUhOBNMo8PSC4ap0ZgYeVBq5aiMaQex0r+uM4 45S1z5N2nkNRYlUARkfKirqQxJ4mtj5XPC/jtdaUiMzvnwcMmLAwPlDNYiU0kO5IqJFBdzmJ yjzomVk1zK9AYS/woeIxETs+s6o7qXtMGGIoMWr6pirpHk4Wgp4TS02BSTSmNzParrFxLpEU dFKq3M0IsBCVGvfNgWL2pKKQVq34fwuBhJFQAigR9B3O9mfaeejrqt73Crp0ng0+Q74+Llzj EIJLOHYTMISTJyxYzhMCQlgPkKoj+TSVkRzBZoYFkUt4OXvlFj73wkeqeF8Z1YWoOCIjwXH9 0u2lPEq0cRHHyK+KSeH1zQJ4xgj0QDGPmkvi81D13sRaaNu3uSfXEDrdYYc+TSZd2bVh2VCr xrcfzQ1uz9fsdC9NPdNd7/mHvcAaNc5e9IhNh67L54aMBkzlJi18d0sWXOOHkyLSvbHnC/OP wv7qCf69PUJmtoeHABEBAAHCwXwEGAEIACYCGwwWIQQRU7b77F4NWhJiYPOr1YfN8GWBrgUC Z3u+zwUJCYbhUQAKCRCr1YfN8GWBrmljD/45mvtqiWzATkikxkJjTlxfhJBGUFXUoPXqvo8l 8zACTTnn6/K7v1TcFmtSHtLqQiTGwwq1vGQSjEG+UFzdXohex9MTv+7JHr+fcQfxFtxYeVGn k9fSkRkIdtpUzuCnBC27VYbq5S+nk4+ophmjm7rFVWd4tz+XTFZkuHTRImWxbaF9EZ/fuWmm XaICw+lzGan9BteM1ZSLIjzSPd7LoG55SuoVtAV91J5oLPo6KDOzgPEffalm2LJo7+ZaAeW6 diQUXxQpvAAROR/l1D1DIIQ0OJOqv0QRFyHt/zBbKgWmGaTQqF5aNab4ukVAt0LMsCkCjA11 HhcUnUwrixHR4V8G3UlHTQsWReiXfPerv/BewTsPHSzIfmufNlrBDfS/uIYdwquZfhOSsK9Z DUJFkaHudJC6tRVQ5LBVFqjgtZDllpAj1cOG7WmlTwHblj/r2+LMpOVHApByNkehEOA2c4Bn tcQ/8qSeorJCyd1/5A5+bUFIfIAJbRz4Ja21JgH107oCMX3hsGEzMnuwplYTf9NP4Dq0FQhK vkXzdnDhhXef8nUqF7l32hj9x1BCLFZ4FFe6iuKD7Q9p83Ca1HDdxauIrsrXTsEr1bjg2o/A JXI4A3sUunmiIf/tu+3riXUhA10P1IG11yEQ4y9ogE6knvOraRBwZ8gvFT7J2YLXJrF5mQ==
In-Reply-To: <20250708154239.DCDCCD25776F@ary.qy>
Content-Type: text/plain; charset="UTF-8"; format="flowed"
Content-Transfer-Encoding: 8bit
Message-ID-Hash: AGSGWTAMTQHVDTVXMSABL6WDCAX6BTIN
X-Message-ID-Hash: AGSGWTAMTQHVDTVXMSABL6WDCAX6BTIN
X-MailFrom: pspacek@isc.org
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-dnsop.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [DNSOP] Re: Collision Free Key Tags for DNSSEC draft
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/eWJVpaHePwPlwSaCnQM9u7kGnCw>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Owner: <mailto:dnsop-owner@ietf.org>
List-Post: <mailto:dnsop@ietf.org>
List-Subscribe: <mailto:dnsop-join@ietf.org>
List-Unsubscribe: <mailto:dnsop-leave@ietf.org>

On 08. 07. 25 17:42, John Levine wrote:
> It appears that Yorgos Thessalonikefs  <yorgos@nlnetlabs.nl> said:
>> Various ways that could give resolution inconsistencies between
>> implementations (I am not considering the actual attack scenario because
>> noone cares about that resolution).
> 
> Different resolvers allow different lengths of CNAME chains before they give up.
> I think that's much more likely to make a practical difference, but we've been
> living with it for decades and dnsop has never provided definitive advice on
> how to deal with it.
> 
> Why is this any more urgent?

For CNAME chains we have seen development over the years, going to 
longer and longer chains. So there's a proof that flexible limit which 
changes over the years makes sense.

For colliding keytags, that's just nonsense. There's no incentive to 
support these and BIND will currently refuse anything with more than one 
collision.

I'm all for declaring
acceptable number of collisions = 0

-- 
Petr Špaček
Internet Systems Consortium

v2.46.0 | Report a Bug | By Email | System Status