Re: [secdir] SecDir review of draft-ietf-dnsop-negative-trust-anchors-10

["Livingood, Jason" <[e-mail]>]

On 6/19/15, 4:24 PM, "Yaron Sheffer" <[e-mail]<mailto:[e-mail]>> wrote:

This is more of a rant than a review, however it presents a security perspective that seems to be at odds with the operational-first perspective of the document.

Keeping in mind your feedback is as you say a rant, I will happily respond below and try to shed some more light on this. ;-)

As an aside, DNSSEC validation penetration would not be where it is today without NTAs. They have become critical; without them it is unlikely DNSSEC would be particularly viable. This is the unfortunate reality, and implementers are doing their best to make the network & namespace more secure within the boundaries of operational reality.

Even assuming that 99.9% of us will continue to trust ISPs for DNS
resolution, IMHO the proposed solution would be better off with more
automation and less celebration of "trained technical personnel". For
example, the document has a SHOULD level requirement to test the NTA
"periodically" in order to eventually remove it.

Automated vs. manual was extensively discussed in the WG and the issue concluded with the text in the document now. Among the concerns with making this more automated were whether an automated, centralized DNSSEC-disablement function would itself be a juicy target of attack to enable downgrade attacks. Aside from that, DNS recursion has always been operated locally, on a distributed basis, and there is local policy such as NTAs that has traditionally a part of this. In the end, the WG felt that not automating this was better than automating it.

How about an
alternative that shifts the responsibility to DevOps or to the actual
vendors, and also empowers the .1% who maintain their own resolvers:

"NTA implementors MUST attempt to validate the domain in question once every MINUTE for the period of time that the Negative Trust Anchor is in place, until such validation is again successful, and MUST remove the NTA as soon as that happens."

FWIW, the document does not have an RFC 2119 reference and so that sort of requirement text would not carry much weight. In practice, however, implementers use NTAs sparingly and are usually in very close contact with the domain owner and are often advised by them of an estimated MTTR.

Regards,
Jason