Re: [DNSOP] Time to update RSAMD5 and perhaps DSA (algs 1 and 3) to MUST NOT?

[Viktor Dukhovni <[e-mail]>]

On Wed, Dec 05, 2018 at 05:14:17PM -0500, Viktor Dukhovni wrote:

> I don't think this counts as a "production" RSAMD5 deployment.

Speaking of "production", some of the DS RRs, don't look like they
were ever intended to work.  The odds against a hex-encoded digest
containing only digits are ~146,000,000 : 1 for SHA1 and are
~11.6*10^12 : 1 for SHA2-256.  And yet looking at the DS RRs with
algorithm 1 I find a large proportion of highly implausible values
consisting of just decimal digits:

    abwg12616-459.com. IN DS 3 1 1 0000000500000000000000000000100000000000
    abwg12616-459.com. IN DS 5 1 1 0000880000000000000000000000100000000000
    abwg12616-459.com. IN DS 6 1 1 0005550000000000000000000000100000000001
    carelifesoftware.com. IN DS 1 1 1 0123456789012345678901234567890123456789
    virtualtechnologycenter.com. IN DS 1 1 1 0987654321012345678954321678900987654321
    adgraphs.com. IN DS 1000 1 1 1111111111111111111111111111111111111111
    digitransservices.com. IN DS 12345 1 1 1111111111111111111111111111111111111111
    floresti-online.net. IN DS 6733 1 1 1111111111111111111111111111111111111111
    redomain20160307.info. IN DS 2 1 1 1111111111111111111111111111111111111111
    rtgdsasdgfasdf.info. IN DS 1 1 1 1111111111111111111111111111111111111111
    techdeft.com. IN DS 3494 1 1 1111111111111111111111111111111111111111
    muakyuc.com. IN DS 111 1 2 1111111111111111111111111111111111111111111111111111111111111111
    zealwebtech.com. IN DS 65535 1 2 1111111111111111111111111111111111111111111111111111111111111234
    googleupdatetask.com. IN DS 1233 1 1 1111111111222222222233333333334444444444
    zenericpharma.com. IN DS 9876 1 1 1111111111222222223333333444444555556666
    antoinecommunications.com. IN DS 142 1 1 1111222233334444555566667777888899990000
    achteam.net. IN DS 12344 1 1 1123494393929493293239234291239423942394
    nobonesaboutitrealty.com. IN DS 1185 1 1 1185118511851185118511851185118511851185
    cossioinsurance.net. IN DS 12021 1 1 1202112021120211202112021120211202112021
    visionaryrhino.com. IN DS 12345 1 1 1234567812345678123456781234567812345678
    226pitsaktest.bid. IN DS 123 1 1 1234567890123456789012345678901234567890
    3-2-2012gdqatesting.com. IN DS 23213 1 1 1234567890123456789012345678901234567890
    cuhksis.com. IN DS 1996 1 1 1234567890123456789012345678901234567890
    diaryofthenarcissist.com. IN DS 2341 1 1 1234567890123456789012345678901234567890
    dooskers.com. IN DS 1212 1 1 1234567890123456789012345678901234567890
    eticaretif.com. IN DS 1453 1 1 1234567890123456789012345678901234567890
    netartdr.com. IN DS 1 1 1 1234567890123456789012345678901234567890
    pratechsol.com. IN DS 65420 1 1 1234567890123456789012345678901234567890
    precreto.com. IN DS 1 1 1 1234567890123456789012345678901234567890
    rastey.com. IN DS 1962 1 1 1234567890123456789012345678901234567890
    reliefsys.com. IN DS 2675 1 1 1234567890123456789012345678901234567890
    rodrigocastilho.com. IN DS 1 1 1 1234567890123456789012345678901234567890
    tokcan.com. IN DS 12345 1 1 1234567890123456789012345678901234567890
    alfahero.com. IN DS 1980 1 1 1234567890123456789012345678901234567899
    guidedtechnologies.net. IN DS 40223 1 1 1234567890987654321012345678909876543210
    civictra.com. IN DS 16738 1 1 1234567891234567891234567891234567891234
    radsw.com. IN DS 62660 1 1 1234567891234567891234567891234567891234
    brdtest011112.com. IN DS 2 1 1 1234567899876543211234567898741236547892
    resellerglobotec.com. IN DS 8110 1 1 1330133013301330133013301330133013301330
    parnanetra.com. IN DS 16 1 1 1641970127196318519661641970127196318519
    hotfix241117-live.info. IN DS 111 1 1 2222211111111111111111111111111111122222
    domcontact.bid. IN DS 1 1 1 2323343444444777444444444444444444444445
    280520143.com. IN DS 123 1 1 2343546788999999999999999999999999999999
    226pitsaktest.bid. IN DS 234 1 2 2345678901234567890123456789012345678901234567890123456788901223
    226pitsaktest.bid. IN DS 2345 1 2 2345678901234567890123456789012345678901234567890123456788901223
    smma.info. IN DS 2222 1 1 2364358523698745214569874563214569874562
    20160418uaqatest.com. IN DS 12423 1 1 3433333333333333333333333333333333455555
    catholicdevotees.com. IN DS 22021 1 1 5869745236789564123656897485236589785412
    careerfunction.com. IN DS 63267 1 1 6326739963267399632673996326739963267399
    laaraa.com. IN DS 45632 1 1 6565788980009087546456558814434135697645
    fatblack-sekai.info. IN DS 46239 1 1 8659796995795649986986869895955499595595
    niceandsharealstate.net. IN DS 65535 1 1 8888888888888888888888888888888888888888
    r2webtech.com. IN DS 1 1 1 9237923792379237923792379237923792379237
    gwaliortimes.in. IN DS 65535 1 1 9425738101942573810194257381019425738101
    poggyaservices.in. IN DS 6887 1 1 9665649035966564903596656490359665649035
    dvdschool.in. IN DS 45678 1 1 9878765413594321222346789009797543214567

There also some clearly made up values that are not all digits:

    0jl.com. IN DS 100 1 1 0123456789abcdef0123456789abcdef01234567
    noblezahotel.com. IN DS 1424 1 1 1111111111aaaaaaaaaa2222222222bbbbbbbbbb
    cardiagen.com. IN DS 2525 1 1 79843759877573822131098790129872653abcde 
    interpro-books.biz. IN DS 123 1 1 a123456789012345678911234567892123456789

No idea why people would just "make up" (non-)random DS records for
their domains, but for some reason some do.  These made-up DS RRs
are present for 56 out of the 139 domains with RSAMD5 DS RRs, but
only rootcanary.net actually has RSAMD5 keys.

Basically, the RSAMD5 DS RRs are toxic waste that often never worked,
or if they ever did, no longer match reality, rootcanary.net aside.

-- 
	Viktor.