Subject: Re: [dnsext] Signing the root with SHA-1 or SHA-2

From: Danny Mayer <[email-masked]>
Date: Sun, 02 Aug 2009 18:58:05 -0400

[ Moderators note: Post was moderated, either because it was posted by
   a non-subscriber, or because it was over 20K.  
   With the massive amount of spam, it is easy to miss and therefore 
   delete relevant posts by non-subscribers. 
   Please fix your subscription addresses. ]

Matthew Dempsky wrote:
> On Wed, Jul 29, 2009 at 1:53 PM, Samuel Weiler<[email-masked]> wrote:
>> Similarly, I hope that we will see several early KSK rollovers, perhaps once
>> a year for the first 3-5 years of having a signed root, just to give
>> resolver operators an opportunity to develop and test their KSK rollover
>> procedures.
> 
> If the goal is to give them operational practice, wouldn't it make
> sense to instead roll keys once or twice a week during a test period
> lasting a few months or something?  Or better, to setup some dummy
> keys/servers that continue to cycle once a week indefinitely so a
> company starting out a few years from now will be able to still test
> that key rollover works fine for them.
> 
> Once a year doesn't seem much better than once every N years for the
> purpose of letting people test their software/configurations/etc.  I
> fear it'll end up like NTP's leap second support: there's protocol
> support and the code's there, but there was still a surprising number
> of problem reports on the technical mailing lists / blogs that I was
> reading when the last one occurred.
> 
> In the NTP leap second case, computers are out of sync by about a
> second.  In the DNS case, host name resolution breaks.

You cannot really compare the two. It's very hard to reset your clock to
test NTP's leap second code. Try setting up an isolated network for
testing this and finding that your clock got reset before you had a
chance to test the leap second part of the code. It's relatively easy to
set up your own copy of the root domain so you can test rollovers.

Danny

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Ondřej Surý <[email-masked]>
Date: Mon, 24 Aug 2009 00:55:29 +0200

On Wed, Jul 29, 2009 at 10:42 PM, Paul Hoffman <[email-masked]>wrote:

> At 9:59 AM -0700 7/29/09, Nicholas Weaver wrote:
> >>>SHA-1 is a known problem.  SHA-256 is better.  Not better ENOUGH (I'd
> >>>like to see a formal commitment to shift to the Advanced Hash function
> >>>winner after it gets NSA approval for Top Secret communication), but
> >>>better.
> >>
> >>References please.
> >
> >Even as old as 2005 it was known SHA-1 had problems:
> >http://www.schneier.com/blog/archives/2005/02/cryptanalysis_o.html
> >http://en.wikipedia.org/wiki/SHA_hash_functions#SHA-1
>
> Please stop the FUD about SHA-1. Those articles are about probable problems
> with SHA1's collision resistance. That is not applicable for the root
> signing TLDs. Even if such a collision can be done (it still has not been
> shown in practice, as compared to MD5), the scenario where it could be of
> damage to DNSSEC is both obscure and trivial to detect.

Paul,

trying not to spread any FUD, could you please comment:

http://www.schneier.com/blog/archives/2009/06/ever_better_cry.html

Ondrej
-- 
Ondrej Sury
technicky reditel/Chief Technical Officer
-----------------------------------------
CZ.NIC, z.s.p.o.  --  .cz domain registry
Americka 23,120 00 Praha 2,Czech Republic
mailto:[email-masked]  http://nic.cz/
sip:[email-masked] <[email-masked]> tel:+420.222745110
mob:+420.739013699     fax:+420.222745112
-----------------------------------------

---

From: Paul Hoffman <[email-masked]>
Date: Sun, 23 Aug 2009 16:15:19 -0700

>http://www.schneier.com/blog/archives/2009/06/ever_better_cry.html

Same comment as earlier on this thread: this is a better-yet attack on the collision resistance, as Bruce says quite clearly. We still haven't seen that there is a relationship between the ever-better attacks on collision resistance and any possible attack on the preimage resistance of any commonly-used hash algorithm. There could be such a relationship, of course; however, no cryptographer has said that they think such a relationship exists.

--Paul Hoffman, Director
--VPN Consortium

---

From: "Aki Tuomi" <[email-masked]>
Date: Mon, 24 Aug 2009 08:42:55 +0300

>-----Original Message-----
>From: [email-masked] [mailto:owner->[email-masked]] On Behalf Of Paul Hoffman
>Sent: 24. elokuuta 2009 2:15
>To: OndÞej Sur~
>Cc: [email-masked]
>Subject: Re: [dnsext] Signing the root with SHA-1 or SHA-2
>
>At 12:55 AM +0200 8/24/09, OndÞej Sur~ wrote:
>Same comment as earlier on this thread: this is a better-yet attack on the >collision resistance, as Bruce says quite clearly. We still haven't seen >that there is a relationship between the ever-better attacks on collision >resistance and any possible attack on the preimage resistance of any >commonly-used hash algorithm. There could be such a relationship, of <course; however, no cryptographer has said that they think such a >relationship exists.
>
>--Paul Hoffman, Director
>--VPN Consortium

Related to SHA-2, I hope you all have seen this...

http://eprint.iacr.org/2008/270.pdf

---
Aki Tuomi

---

From: Florian Weimer <[email-masked]>
Date: Mon, 24 Aug 2009 08:21:18 +0000

* Paul Hoffman:

> Same comment as earlier on this thread: this is a better-yet attack
> on the collision resistance, as Bruce says quite clearly. We still
> haven't seen that there is a relationship between the ever-better
> attacks on collision resistance and any possible attack on the
> preimage resistance of any commonly-used hash algorithm.

Signatures on DS records require some form of collision resistance,
not preimage resinstance, because you sign attacker-provided data.
Randomized hashing can provide a workaround, as discussed before.

(This is really quite different from that HMAC stuff.)

-- 
Florian Weimer                <[email-masked]>
BFK edv-consulting GmbH       http://www.bfk.de/
Kriegsstraße 100              tel: +49-721-96201-1
D-76133 Karlsruhe             fax: +49-721-96201-99

---

From: Paul Hoffman <[email-masked]>
Date: Mon, 24 Aug 2009 07:41:23 -0700

>Randomized hashing can provide a workaround, as discussed before.

With all due respect, this is FUD. Please re-read the thread. Earlier, I said:

At 10:42 PM +0200 7/29/09, Paul Hoffman wrote:
>Even if such a collision can be done (it still has not been shown in practice, as compared to MD5), the scenario where it could be of damage to DNSSEC is both obscure and trivial to detect.

That statement is still true. Even when SHA-1 collisions become practical, a signer detecting them is trivial.

The scenario you are talking about is a fully-automated certificate authority who is doing no checking of what they are signing. I do not believe that anyone in the DNSSEC community believes that this will be true of signing the root.

--Paul Hoffman, Director
--VPN Consortium

---

From: Florian Weimer <[email-masked]>
Date: Mon, 24 Aug 2009 14:52:03 +0000

* Paul Hoffman:

> With all due respect, this is FUD.

Huh?

> Please re-read the thread. Earlier, I said:
>

>>Even if such a collision can be done (it still has not been shown in
>>practice, as compared to MD5), the scenario where it could be of

This statement is true, *except* for signatures on DS records.

If an attack is performed against them, it is as trivial to detect as
a forged X.509 certificate created using Lenstra et al.'s method.
That is, not trivial at all.

DNSSEC can't magically defuse the effect of bad crypto algorithms.
Through its delegation concept, it has less exposure than other
frameworks because you generally sign only your own data, but at the
delegation points, you need a good signature algorithm because that
assumption doesn't hold.

---

From: Paul Hoffman <[email-masked]>
Date: Mon, 24 Aug 2009 09:10:05 -0700

>This statement is true, *except* for signatures on DS records.

OK, I'm missing something. Please show how the zone admin for badactor.com can mount an attack on example.com using DS records signed using a hash algorithm for which collisions are trivial but primages are impossible.

--Paul Hoffman, Director
--VPN Consortium