Subject: Re: [dnsext] RFC 4035 section 3.1.6 - security hole?

From: Edward Lewis <[email-masked]>
Date: Tue, 20 Apr 2010 14:59:08 -0400

At 19:15 +0100 4/20/10, George Barwood wrote:

>Why this odd exception?  It's certainly not hard.

1. The goal is to protect the data from the signer to the validator. 
A server acting in an authoritative role (= setting the AD bit) 
doesn't need to care.

2. Validating what could be millions of signatures when loading a 
zone from disk takes a while.

3. As far as zone transfers, use of TSIG or VPN or secure file 
transfers are a lot more efficient than individual verifications.

I'd encourage you to look at this page:
http://www.ops.ietf.org/lists/namedroppers/namedroppers.2001/threads.html

and pull up all of the messages with this in the subject line:
      I-D ACTION:draft-ietf-dnsext-ad-is-secure-03.txt

There are 80 of them.
-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis             
NeuStar                    You can leave a voice message at +1-571-434-5468

Wouldn't it be nice if all of the definitions of equivalence were the same?

---

From: Olafur Gudmundsson <[email-masked]>
Date: Thu, 22 Apr 2010 14:31:05 -0400

On 20/04/2010 6:05 PM, George Barwood wrote:
>
> ----- Original Message -----
> From: "Edward Lewis"<[email-masked]>
> To: "George Barwood"<[email-masked]>
> Cc:<[email-masked]>
> Sent: Tuesday, April 20, 2010 7:59 PM
> Subject: Re: [dnsext] RFC 4035 section 3.1.6 - security hole?
>
>
> Agreed. But if the server is responding to a recursive query ( RD=1 ),
> it should validate ( if it is a validating resolver ).

If stub is asking a mixed-mode DNS responder (i.e. both authoritative
and recursive) the stub has no idea if RD=1 or RD=0 is more
appropriate for each question, for that reason it will always use RD=1.

> There is no need to do that. If a server is authoritative for a large
> zone, it probably shouldn't be offering recursive service, except perhaps
> to itself and possibly a very limited set of local clients. Certainly not to a
> large number of clients, which could generate a large validation load.
> Signatures need only be validated on demand.
>
> To be clear : if RD=0, validation does not happen. That's authoritative service.
> Validation is not expected or desired. If RD=1, validation must happen, if the server
> is a validating server, in my view.

See comment above, why does authoritative server have to validate data 
just because a query arrives with RD=1?

>
> An example where this would be important if where a server wishes to authenticate
> a software upgrade using a certificate published securely in the DNS. It's bad if the
> validation doesn't happen simply because the server in question is a slave for the
> zone in question. That would probably cause the upgrade to abort ( since AD = 0 ),
> causing general chaos.
>

> Those are link-level secure. The objective of DNSSEC is end-to-end security.
> To verify that the data is what was signed. If say the master server has been
> compromised, TSIG and VPN won't help.
>

Yes if the distribution server is compromised all bets are off IFF
	zone is unsigned
or 	master server contains private part of the zone signing key.

> I looked at about 20 or so quickly.
> Obviously this was a contentious issue for some reason that I cannot fathom.
> It's quite bizarre to have end-to-end security with unpredictable exceptions.
> Hopefully no actual implementations do this, I'd certainly classify it as a major security bug.

please explain clearly what you can not fathom?

Until you clearly state what exactly the issue is it is hard to accept 
your assessment that this is "a major security issue".

	Olafur