Subject: [DNSOP] CDS/CDNSKEY RRSet authentication

From: Tony Finch <[email-masked]>
Date: Sat, 29 Jul 2017 22:00:53 +0100

I think I have spotted a lacuna or possibly erratum in RFC 7344.

In section 4.1 bullet 2 it says:

   o  Signer: MUST be signed with a key that is represented in both the
      current DNSKEY and DS RRsets, unless [unusual case]

This allows a setup where

* the DNSKEY RRset contains a ZSK and a KSK

* the DNSKEY RRset is signed by the KSK (of course)

* the CDS and CDNSKEY RRsets are signed by the ZSK (weirdly)

* the parent contains DS records corresponding to both the KSK (of
  course) and the ZSK (weirdly)

In this weird setup the ZSK's DS can't authenticate the delegation (per
RFC 4035 section 5.2) but it does authenticate the CDS/CDNSKEY RRsets.

Is this intended?

Or was RFC 7344 supposed to say something like:

   o  Signer: MUST be signed with a DNSKEY RR that authenticates the
      delegation as described in RFC 4035 section 5.2 or any subsequent
      updates, unless [unusual case]

One particularly relevant update is RFC 4509 which has extra requirements
about ignoring SHA-1 DS records if SHA-2 records are present. Should this
check also apply to CDS / CDNSKEY RRsets?

Tony.
-- 
f.anthony.n.finch  <[email-masked]>  http://dotat.at/  -  I xn--zr8h punycode
Portland, Plymouth: Cyclonic, mainly west or southwest, 5 to 7. Moderate or
rough. Rain then showers. Moderate or poor, becoming good.

---

From: Tony Finch <[email-masked]>
Date: Sat, 29 Jul 2017 22:22:17 +0100

Another one:

It isn't clear to me if the preamble paragraphs in RFC 7344 section 4 are
supposed to describe requirements on the publisher or the processor or
both.

In particular, is the parental agent supposed to check this? -

                                               If the Child publishes
   both, the two RRsets MUST match in content.

If not, maybe that paragraph should have been in section 5 not section 4...

Tony.
-- 
f.anthony.n.finch  <[email-masked]>  http://dotat.at/  -  I xn--zr8h punycode
Shannon: West 5 or 6. Moderate or rough. Showers. Good occasionally poor.

---

From: Mark Andrews <[email-masked]>
Date: Sun, 30 Jul 2017 10:38:32 +1000

In message <[email-masked]>, Tony Finch
>       current DNSKEY and DS RRsets, unless [unusual case]

It just means that signers that know about ksk/zsk have special rules
for cds and cdnskey.  This is from BIND's dnssec-signzone and causes
the cds and cdnskey rrsets to be signed with both ksk and zsk dnskeys.

                } else if (set->type == dns_rdatatype_cds ||
                           set->type == dns_rdatatype_cdnskey ||
                           iszsk(key)) {

> RFC 4035 section 5.2) but it does authenticate the CDS/CDNSKEY RRsets.

The purpose was for the CDS/CDNSKEY tools to not have to fetch the
current DNSKEY RRset to be able to validate the records provided they
have a current KSK.
 
> _______________________________________________
> DNSOP mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dnsop
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]