Subject: [DNSOP] Implementation status for ZONEMD?

From: Paul Hoffman <[email-masked]>
Date: Fri, 18 Dec 2020 21:57:15 +0000

Greetings. Now that ZONEMD is waiting in the RFC Editor's queue, I was wondering how the developers are coming with implementation. The protocol is ripe for two-party testing.

--Paul Hoffman

---

From: Benno Overeinder <[email-masked]>
Date: Tue, 22 Dec 2020 01:07:10 +0100

Hi Paul,

> Greetings. Now that ZONEMD is waiting in the RFC Editor's queue, I was wondering how the developers are coming with implementation. The protocol is ripe for two-party testing.

<NLnet Labs hat on>

We have implemented ZONEMD (verification and DNSSEC validation) in 
Unbound, ready to be merged into the main branch and released early next 
year.

Cheers,

-- Benno

-- 
Benno J. Overeinder
NLnet Labs
https://www.nlnetlabs.nl/

---

From: Willem Toorop <[email-masked]>
Date: Tue, 22 Dec 2020 10:27:53 +0100

Op 22-12-2020 om 01:07 schreef Benno Overeinder:
>> Greetings. Now that ZONEMD is waiting in the RFC Editor's queue, I was
>> wondering how the developers are coming with implementation. The
>> protocol is ripe for two-party testing.
> 
> <NLnet Labs hat on>
> 

Recently, also the ldns library has been extended with zone-digest
functionality. ZONEMD RRs can now be calculated and added with
ldns-signzone , and verified with ldns-verify-zone .
This is available on the develop branch on

	https://github.com/NLnetLabs/ldns

this will also be released early next year.

Usage: ldns-signzone [OPTIONS] zonefile key [key [key]]
  signs the zone with the given key(s)
  -z <[scheme:]hash>	Add ZONEMD resource record
		<scheme> should be "simple" (or 1)
		<hash> should be "sha384" or "sha512" (or 1 or 2)
		this option can be given more than once
  -Z		Allow ZONEMDs to be added without signing

Usage: ldns-verify-zone [OPTIONS] <zonefile>
	Reads the zonefile and checks for DNSSEC errors.

It checks whether NSEC(3)s are present, and verifies all signatures
It also checks the NSEC(3) chain, but it will error on opted-out delegations
It also checks whether ZONEMDs are present, and if so, needs one of them
to match the zone's data.

OPTIONS:
	-Z	Requires a valid ZONEMD RR to be present.
		When given once, this option will permit verifying
		just the ZONEMD RR of an unsigned zone. When given
		more than once, the zone needs to be validly DNSSEC
		signed as well.

Cheers,

-- Willem

---

From: Benno Overeinder <[email-masked]>
Date: Wed, 23 Dec 2020 15:03:34 +0100

Hi,

> Unbound, ready to be merged into the main branch and released early next 

Forgot to mention that we tested this with the implementation by Duane 
Wessels, as mentioned in the draft Appendix B.1.  Note that this 
implementation differs from the implementation that Willem mentioned in 
his email to the mailing list.

Cheers,

-- Benno

---

From: Benno Overeinder <[email-masked]>
Date: Wed, 23 Dec 2020 15:25:43 +0100

> this will also be released early next year.

With ZONEMD verification in ldns-verify-zone, and CreDNS zone 
verification mechanism in NSD, there is also support for ZONEMD 
verification in NSD (not signing!).  With a zone transfer (inbound), 
NSD/CreDNS verifies the zone integrity using ldns-verify-zone.  Only if 
the zone is correct will the zone be transferred (outbound) to (public) 
secondary name servers.

See also the IETF 109 DNSOP WG presentation of Willem: 
https://datatracker.ietf.org/meeting/109/materials/slides-109-dnsop-sessb-dns-hackathon-results-00.

Best,

-- Benno