IETF Logo Mail Archive

Re: [DNSOP] New Version Notification for draft-wessels-dns-zone-digest-01.txt

"John Levine" <johnl@taugh.com> Sun, 29 July 2018 15:50 UTC

Return-Path: <johnl@iecc.com>
X-Original-To: dnsop@ietfa.amsl.com
Delivered-To: dnsop@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D9AF6130E67 for <dnsop@ietfa.amsl.com>; Sun, 29 Jul 2018 08:50:18 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.751
X-Spam-Level:
X-Spam-Status: No, score=-1.751 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.25, SPF_PASS=-0.001] autolearn=no autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1536-bit key) header.d=iecc.com header.b=AbGCIiEB; dkim=pass (1536-bit key) header.d=taugh.com header.b=JhA5LW4y
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DsaGrPD-z1yi for <dnsop@ietfa.amsl.com>; Sun, 29 Jul 2018 08:50:18 -0700 (PDT)
Received: from gal.iecc.com (gal.iecc.com [IPv6:2001:470:1f07:1126:0:43:6f73:7461]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C828D130DC8 for <dnsop@ietf.org>; Sun, 29 Jul 2018 08:50:17 -0700 (PDT)
Received: (qmail 22998 invoked from network); 29 Jul 2018 15:50:15 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=iecc.com; h=date:message-id:from:to:cc:subject:in-reply-to:mime-version:content-type:content-transfer-encoding; s=59d2.5b5de237.k1807; bh=hliSH0hGFIbt+h/BOadOjTvSmbumktBJngTUP1s/vVg=; b=AbGCIiEBGW8ZJ/C11H+MQ3oya7G/lNvqENbNAJ9c8oCZU5wGy9D2P2brY7FUCvIws4md9qPir3ZezPLS5mF01ZLTzRL8KUMIVH4/yOc/lFMdWxjNGhvM6hhDKbsMDhU8/v6cgWFme8oY25UNkakDhh83y03/LSS9AxYX5M7RDba1CRdU8oZEU9KA1j49flupu+wLe+75BuNYmh/zZI95spo+bhpfJSxYYZ0O2366PxZIV2keg04g54+9PYXIWa/C
DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=taugh.com; h=date:message-id:from:to:cc:subject:in-reply-to:mime-version:content-type:content-transfer-encoding; s=59d2.5b5de237.k1807; bh=hliSH0hGFIbt+h/BOadOjTvSmbumktBJngTUP1s/vVg=; b=JhA5LW4yCCZx0afXrlk5B+f/ZDdiFlD96Y2ck5ny75sYclPPNuFPbQHID0CWNdbw7/xz4hIBgqaEmzlhKPwTIFryxJ+kxj0anZlTRIs8z85TjivPbH+Q+2fQqwUxwtMyiUntyPUwlF7Jmiwggj4bbPBwNvYrD8oU9TC9qMKUhndhTUeIvOmM0wByzLYDSyBWWnNm3DqM4DQf0tSskfcu+rQ6a9PAd9uQkHTUWkCHgjHrhw9VNwGajISRNvBPadoN
Received: from ary.qy ([IPv6:2001:470:1f07:1126::78:696d:6170]) by imap.iecc.com ([IPv6:2001:470:1f07:1126::78:696d:6170]) with ESMTP via TCP6; 29 Jul 2018 15:50:15 -0000
Received: by ary.qy (Postfix, from userid 501) id C8F2C20030CD40; Sun, 29 Jul 2018 11:50:13 -0400 (EDT)
Date: Sun, 29 Jul 2018 11:50:13 -0400
Message-Id: <20180729155014.C8F2C20030CD40@ary.qy>
From: John Levine <johnl@taugh.com>
To: dnsop@ietf.org
Cc: ondrej@isc.org
In-Reply-To: <D2923107-B7D1-4ED6-AAC6-C65553BDEFEB@isc.org>
Organization: Taughannock Networks
X-Headerized: yes
Mime-Version: 1.0
Content-type: text/plain; charset="utf-8"
Content-transfer-encoding: 8bit
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/jNvp0-zg1fto4hA2JJyCdCLKd3A>
Subject: Re: [DNSOP] New Version Notification for draft-wessels-dns-zone-digest-01.txt
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.27
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop/>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 29 Jul 2018 15:50:19 -0000

In article <D2923107-B7D1-4ED6-AAC6-C65553BDEFEB@isc.org> you write:
>Mail headers doesn’t have NSEC records.  Also any operation where you need to reconstruct the file by combining bits from
>different places/channels is prone to errors.
>
>You need to know the hash is valid before you start the download. Therefore the hash has to be signed.

We must have some basic difference in our mental models here.  Mine is:

1.  Download the zone from wherever.

2.  Sort the records and compute the hash.

3.  Check that the hash you computed matches the one in the ZONEMD.

4.  Check that the DNSSEC signature of the ZONEMD is valid.

If all that works, use the zone.  If not, throw it away.

What am I missing?

v2.23.0 | Report a Bug | By Email