Re: [DNSOP] [Ext] Re: Resolver behaviour with multiple trust anchors

[Petr Špaček <[e-mail]>]

On 1.11.2017 12:11, Edward Lewis wrote:
> On 10/31/17, 20:50, "DNSOP on behalf of Mark Andrews" <[e-mail] on behalf of [e-mail]> wrote:
>    
>> Secondly doing deepest match on trust anchors is the only secure way to prevent a parent overriding the child zone's security policy.

Even though Knot Resolver implements "use any" (DS or trust anchor,
whichever matches), I think we should move to "deepest match on trust
anchors", i.e. I agree with Mark.

"Use any" strategy is insecure and will surprise people, as ilustrated
by reaction from Edward quoted below:

> By this, do you mean choice of cryptographic algorithm and/or length?
> To achieve "independence" in this way, the child can simply refuse to
> have a DS record at the parent and then lean on managing trust anchors
> at all relying resolvers.

With current implementation of "use any" nothing prevents the parent
from publishing a DS and thus hijacking the domain without clients
noticing even if there was a local TA installed for given subdomain on
clients.

For this reason I propose to document that "deepest match" is mandated
behavior.

-- 
Petr Špaček  @  CZ.NIC