Subject: hash algorithm roll

From: "Olaf M. Kolkman" <[email-masked]>
Date: Thu, 03 Mar 2005 14:43:12 +0100

I've started a new thread.

I think we all agree that by using a scheme like the algorithm roll we 
can reliably move NSEC to NSEC3. Those validators that do not have NSEC3 
implemented will have a "signed record" that will tell them this zone 
will use NSEC3 and those validators that do not understand NSEC3 will 
treat the data from that zone as insecure.

A zone that would want to roll from NSEC to NSEC3  can do so gradually 
(if the signalling is done via algorithm rolls) as there is no
down-grade attack possible.

I am trying to assess if one can gradually go from NSEC3 with hash-algo 
'a' to NSEC3 with hash-algo 'b' and I do not think it is possible. 
Changing hash-algorithms would be a flag date event. Even if the server 
would hand out NSEC3s with both hash-algos stripping of one of the NSEC3 
RRs would go unnoticed as they are not tied together by an RRSIG.

I seriously wonder if a domainowner (whose custommers pay to get  secure 
delegations) would change the hashing algorithm so that a fair 
persentage of the validators in the field, that previously saw the zone 
as secure, now treat sub-domains become insecure.

In other words I think that hash-algorithm rollover has its problems 
unless we make clear to the validator which hash algorithms to expect.

(One of the signaling algorithms I can come up with is that the zone 
owner needs to use the same hashing algorithms in the NSEC3 as that are 
used in the signing algorithms. ugly ugly.)

--Olaf
   (namedropper)

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>