Subject: NSEC2 on existing records

From: Don Stokes <[email-masked]>
Date: Thu, 03 Jun 2004 11:33:23 +1200

Having just got my head around NSEC2, I wonder if the hash lookup of
NSEC2 records is really required for names that do actually exist.

That is, can we move the "this name exists but we don't have the RRset
you asked for" function into the EXISTS function, rather than the NSEC2
function, and remove the type bitmap from the NSEC2 record?

That is, given:

@		...
foo		A	10.0.0.1
		RRSIG	A <sig foo A>
		EXISTS	A RRSIG EXISTS
		RRSIG 	EXISTS <sig foo EXISTS>
bar		A	abc
		RRSIG	A <sig bar A>
		MX	0 xyz
		RRSIG	MX <sig bar MX>
		EXISTS	A MX RRSIG EXISTS
		RRSIG 	EXISTS <sig bar MX>

hash(@)		NSEC2	hash(foo)
		SIG	NSEC2 <sig hash(@) NSEC2>
hash(foo)	NSEC2	hash(bar)
		SIG	NSEC2 <sig hash(foo) NSEC2>
hash(bar)	NSEC2	hash(@)
		SIG	NSEC2 <sig hash(bar) NSEC2>

The cases would be:

Query "foo A" would return:

	foo	A 	10.0.0.1
		RRSIG 	A <sig foo A>

providing authenticated data;

"foo MX ?" would return:

	foo	EXISTS	A RRSIG EXISTS
		RRSIG	EXISTS <sig foo EXISTS>

providing authenticated denial of the specific RRset, but without
requiring a hash computation;

"baz A ?" would return:

	hash(foo) NSEC2	hash(bar)

providing authenticated denial of the name, requiring a hash computation.

This approach is most useful to zones containing large numbers of
unsecured delegations, as queries to such delegations don't incur a hash
lookup to authenticate the lack of DS record.

I also think this cuts down on the needed data in the two types of
authenticated denial -- in the "name exists" case, you don't actually
need the next domain pointer, and in the "no name" case, you don't need
a types bitmap for a name you didn't actually query.

Have I missed something important?

-- don

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Ben Laurie <[email-masked]>
Date: Fri, 04 Jun 2004 15:30:49 +0100

Don Stokes wrote:
> Ben Laurie <[email-masked]> wrote:
>>The downside of this proposal is that currently EXISTS records are only 
>>needed to prove closest enclosers that otherwise don't exist. You'd be 
>>introducing them for every name in the zone - and you'd still have to 
>>have NSEC2 records. The upside, if I understand, is that for the case of 
>>proving existence you'd save the size of the hash of the next domain 
>>name in the response. Not sure the upside is worth the downside.
> 
> 
> The point of the proposal is (a) to cut the amount of work required 
> for authenticated denial of RRsets in existing names using NSEC2, and
> (b) to cut the traffic on the wire in both authenticated denial cases.  
> 
> The expense, as you say, is to add an additional RR and its signature to
> the zone, making zone signing harder. 
> 
> Where I'm coming from with regard to (a) is that TLD zones would contain
> vast numbers of insecure delegations, especially early in the game, and
> every one of those insecure delegations would need to generate hashed
> NSEC2 records for security-aware resolvers.  While authoritative name
> servers could internally link each name with its NSEC2 hash at zone load
> time, that link has to be computed on the fly by security-aware
> resolvers every time a query is made via those delegations.
> 
> If the NSECINFO iteration count is high to deter offline dictionary
> attacks, those hash computations could get expensive for smaller
> resolvers.

The general idea is that the cost of the hash computation should be 
similar to the cost of making a query, so although it will increase the 
expense for resolvers it should not be by an order of magnitude.

But indeed, I take your point. Since the name exists and a query has 
been made for it, I can't see the harm (apart from adding an awful lot 
of records) in proving the lack of a DS with an EXISTS.

Cheers,

Ben.

-- 
http://www.apache-ssl.org/ben.html       http://www.thebunker.net/

"There is no limit to what a man can do or how far he can go if he
doesn't mind who gets the credit." - Robert Woodruff