Re: [DNSOP] zonemd/xhash versus nothing new

[Petr Špaček <[e-mail]>]

On 30.7.2018 15:32, Tony Finch wrote:
> Paul Wouters <[e-mail]> wrote:
>>
>> We are looking at a way to distribute the root zone, presumably to
>> make the root servers less mission critical and for enhanced
>> privacy and reduced NXDOMAIN queries.
> 
> RFC 8198 with qname minimization give you the latter two.
> 
>> We are depening on DNSSEC for integrity of the data, which just misses
>> glue/NS verification.
> 
> I keep thinking it might make sense to sign non-authoritative delegation
> records, though it's really hard to see how we could get there from here.
> For instance, there isn't a flags field in RRSIG so you can't explicitly
> mark an RRset as being non-authoritative.

It is! RRSIG has signer name field which points to node with particular
DNSKEY. If signer name is shorter than zone apex name the signature was
created by someone up the tree.

I think this is an interesting idea worth exploring.

Petr Špaček  @  CZ.NIC


> 
>> It seems the way to fix this would be to have well known recursive servers
>> (8.8.8.8, 1.1.1.1, 4.4.4.4, level3, opendns, etc) also offer the root
>> zone for AXFR.
> 
> This just makes the surveillance capitalists part of your mission critical
> problem area, which isn't obviously an improvement.
> 
> Tony.