Subject: Re: DNS SRV question (was Re: please post updated draft)

From: Rob Austein <[email-masked]>
Date: Sat, 13 Nov 1999 16:30:10 -0500

Date: Fri, 29 Oct 1999 19:19:38 -0400 (EDT)
   From: Brian Wellington <[email-masked]>

   On Fri, 29 Oct 1999, Rob Austein wrote:

   >    ...NXT generation is part of the atomic processing of a dynmic
   >    update.  This does cause there to be a private zone key
   >    present on a network-connected host, which is a vulnerability
   >    but not a show-stopper.
   > 
   > One way of handling this (suggested to me by Steve Bellovin)
   > would be to use a separate key for NXT signatures.  Keep the NXT
   > private key online, keep the other zone key offline.  This
   > solution is not for everybody, but it might be a reasonable
   > compromise in some situations.

   The problem with this is that if data is signed with a valid zone key,
   it's considered secure.  If someone compromised the online NXT signing
   key, they could sign other records with it, and a secure resolver could
   not know that this was data signed with the special 'NXT only' key.  The
   net result is no different than having only one zone key for a dynamic
   zone, which is online.

I believe that your analysis is correct as far as it goes, but it only
covers the existing spec with no out-of-band configuration information
at the resolver.

a) We could add goop to the KEY RR to indicate that a certain key can
   only be used for signing NXT RRs.  I'd prefer a more general
   mechanism so that we don't have to drive off this bridge again in
   the near future, but perhaps a NXT-specific kind of KEY is the
   best we can do.

b) There's always the possibility of out-of-band configuration
   information at the resolver.  Paranoid implementations will
   undoubtedly end up with some of this anyway, since the
   administrators of paranoid sites will almost certainly trust
   certain parties well-known to them more than they trust the global
   root and TLD zone administrators.  From there it's a trivial extra
   step to trust certain zone keys more than others.  The problem with
   this approach, of course, is that it scales badly for the site
   administrator, but such is the price of paranoia.

Thus, while I believe that your analysis holds for the common simple
case with the current specification, the separate NXT key may still be
worth considering.

---

From: Bill Sommerfeld <[email-masked]>
Date: Sun, 14 Nov 1999 14:32:22 -0500

>    administrator, but such is the price of paranoia.

Now, I'm a security type, so that may mean that I really *am*
paranoid, but, given how frequently entries get accidentally deleted
from the top-level domains due to operational glitches, it doesn't
seem particularly paranoid to me to configure in the local domain's
signature key(s) into a resolver such that the local key trumps the
root key when it comes to information in the local zone.

					- Bill