Re: [dnsext] Validator assumptions: what algorithms need to properly sign a zone?

Mark Andrews writes:
> 
> In message <4F6CE5E0.1090309@ogud.com>, Olafur Gudmundsson writes:
> > On 23/03/2012 14:23, Tony Finch wrote:
> > > Olafur Gudmundsson<ogud@ogud.com>  wrote:
> > >>
> > >> The zone seems to be in compliance with the list in RFC4035 section 2.2 
> i.
> > e.
> > >> there exists a valid signature by a key in the DNSKEY RRset.
> > >> But in the final paragraph that seems to be contradicted and does
> > >> require the a signing key for all algorithms to be in the DNSKEY RRset.
> > >
> > > I believe the consensus is that that requirement applies to the signer
> > > not the validator.
> > >
> > >> What algorithms can a validator use to validate records from a zone
> > >>    2) any algorithm in the validated DNSKEY RRset
> > >
> > > Tony.
> > 
> > but the validator needs to take into account what the signer is 
> > allowed/required to do we cannot have totally disjoint 
> > requirements/assumptions.
> 
> We don't have disjoint requirement.  The DS records / configured
> trust anchors for the zone set up a expection for the zones contents
> by listing the algorithms that are expected to work.  The signer
> meets those expections by ensuring that each RRset is signed as
> described.  This takes in to account the affects of caching associated
> with introducing new signing algorithm to a zone.

The "must sign with every algorithm in the DNSKEY RRset" was a
*simple* rule for the *signer* to follow to ensure that there
wouldn't be validation failures.  We could have written a much more
complicated rule about when a signature was required or not but it
would have been complicated to describe and would likely not be
implemented properly.

> It is NOT the signers job to check that every RRSIG set contains
> every algorithm listed in the DNSKEY RRset as the contents of these
> can and often will be from different versions of the zone signed
> at different times.  If the validator is paranoid it MAY check every
> algorithm listed in the DS RRset/trust anchors is present and it
> MAY ignore algorithms not in the DS RRset/trust anchors.
> 
> The validator however MUST NOT check that every algorithm listed
> in the DNSKEY RRset is present in every RRSIG set.
> 
> -- 
> Mark Andrews, ISC
> 1 Seymour St., Dundas Valley, NSW 2117, Australia
> PHONE: +61 2 9871 4742                 INTERNET: marka@isc.org
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: marka@isc.org
_______________________________________________
dnsext mailing list
dnsext@ietf.org
https://www.ietf.org/mailman/listinfo/dnsext