Subject: DNSKEY flags field

From: Simon Josefsson <[email-masked]>
Date: Thu, 10 Jun 2004 16:39:22 +0200

Hello.  I think the flags field of DNSKEY could be improved to
facilitate future revisions.  The dnssec-records says in 2.1.1:

   Bits 0-6 and 8-14 are reserved: these bits MUST have value 0 upon
   creation of the DNSKEY RR, and MUST be ignored upon reception.

Always ignoring unknown bits remove the possibility of using the flags
field as an upgrade path in future revisions of DNSSEC.  What do
people think about changing the above to:

   Bits 0-6 and 8-14 are reserved: these bits MUST have value 0 upon
   creation of the DNSKEY RR, and bits 0-6 MUST be ignored upon
   reception, and non-zero values in bits 8-14 MUST cause the DNSKEY
   to be considered invalid for purposes of RRSIG validation.

This would allow DNSSECter to use bits 0-6 for non-critical signaling
of new features, and to use bits 8-14 for critical signaling of new
features.

Of course, if after more consideration, it is realized that using the
flags field is not a reliable way to signal features DNSSECter want to
communicate, then EDNS or some other solution can be used instead.
But adopting the above text would make it possible to have this option
open for DNSSECter.

What do you think?

Thanks,
Simon

PS. This message was reposted here because my post to [email-masked]
appear to have neither arrived, bounced or generated a moderation
notify.  If you receive duplicates, I apologize.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Jim Reid <[email-masked]>
Date: Tue, 15 Jun 2004 12:20:22 +0100

>>>>> "Jelte" == Jelte Jansen <[email-masked]> writes:

    Jelte> Assuming that SHA1 is a good hashing algorithm (and I do
    Jelte> not know of any attacks against it, which is about the only
    Jelte> validation you can have in crypto, so it probably is), I
    Jelte> think that forging collisions is not a problem here.

Once upon a time, the world thought that MD5 collisions were unlikely.
And before that ISTR the same thing being said about a Snefru or some
other Merkle(?) hash algorithm. So it would be prudent to assume that
one day someone will find SHA collisions, however unlikely that seems
to be today. That scenario should however be closed off by allowing
for new hash/crypto algorithms to be introduced for DNSSEC: ie SHA-N
is "stronger" than SHA-(N-1).

Please remember too that just because no attacks have been published,
doesn't mean they don't exist. The inventors of DES said they knew
about differential cryptanalysis (or at least NSA hinted at it) 20-odd
years before Biham and Shamir invented it.