Subject: [dnsext] Checking RRSIG RR validity

From: Sean Wells <[email-masked]>
Date: Fri, 31 Dec 2010 08:54:38 -0800

Hi,

In section 5.3.1 of RFC 4035 :

  The RRSIG RR's Signer's Name field MUST be the name of the zone
  that contains the RRset.

  The matching DNSKEY RR MUST be present in the zone's apex DNSKEY
  RRset, and MUST have the Zone Flag bit (DNSKEY RDATA Flag bit 7)
  set.

My question is with respect to the first two MUSTs: "MUST be the name
of the zone" and "MUST be present in the zone's apex DNSKEY RRset".
What does a validating stub resolver (that uses recursive query mode)
expected to do for implementing these two MUSTs ?

Thanks

Sean
_______________________________________________
dnsext mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dnsext

---

From: Francis Dupont <[email-masked]>
Date: Fri, 31 Dec 2010 18:08:58 +0100

In your previous mail you wrote:

   

=> yes of course: there is a trivial attack if the first is not done
and possible (i.e., sure) confusion with other DNSKEY RR usages for
the second.

Happy New Year!

[email-masked]
_______________________________________________
dnsext mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dnsext

---

From: "George Barwood" <[email-masked]>
Date: Fri, 31 Dec 2010 17:55:12 -0000

I agree the standard is not explicit here. These are my thoughts on this:

Checking Signer Name in RRSIG record

The standard is not very clear on how the Signer Name in an RRSIG record is checked. It simply says "The RRSIG RR's Signer's Name field MUST be the name of the zone that contains the RRset." ( RFC4035, section 5.3.1 )

Unfortunately a validating resolver does not know the zone in a secure way, so it's unclear how this is to be implemented.

Instead, the actual checks need to be:

(1) The Signers name must be equal to or a direct ancestor of the Owner of the RRSIG.

(2) If TypeCovered is DS, the Signers name must not be equal to the Owner of the RRSIG.

(3) The Signers name must not be above the Active trust anchor.

Optionally, for types that can only occur signed in the zone apex ( SOA, NS, DNSKEY, NSEC3PARAM ) an additional check that the Signers name is equal to the Owner of the RRSIG can be performed.

>From http://www.george-barwood.pwp.blueyonder.co.uk/DnsServer/NotesOnDNSSSEC.htm

Regards,
George
  ----- Original Message ----- 
  From: Sean Wells 
  To: [email-masked] 
  Sent: Friday, December 31, 2010 4:54 PM
  Subject: [dnsext] Checking RRSIG RR validity

  Hi,

  The RRSIG RR's Signer's Name field MUST be the name of the zone
  that contains the RRset.  The matching DNSKEY RR MUST be present in the zone's apex DNSKEY
  RRset, and MUST have the Zone Flag bit (DNSKEY RDATA Flag bit 7)
  set.My question is with respect to the first two MUSTs: "MUST be the name of the zone" and "MUST be present in the zone's apex DNSKEY RRset". What does a validating stub resolver (that uses recursive query mode) expected to do for implementing these two MUSTs ?
ThanksSean

------------------------------------------------------------------------------

---

From: Sean Wells <[email-masked]>
Date: Fri, 31 Dec 2010 11:36:38 -0800

On Fri, Dec 31, 2010 at 9:55 AM, George Barwood <
[email-masked]> wrote:

> The standard is not very clear on how the Signer Name in an RRSIG record is
> checked. It simply says "The RRSIG RR's Signer's Name field MUST be the name
> of the zone that contains the RRset." ( RFC4035, section 5.3.1 )
>
> Unfortunately a validating resolver does not know the zone in a secure way,
> so it's unclear how this is to be implemented.
>
>
That is exactly my issue.

> Optionally, for types that can only occur signed in the zone apex ( SOA,
> NS, DNSKEY, NSEC3PARAM ) an additional check that the Signers name is equal
> to the Owner of the RRSIG can be performed.
>
>  From
> http://www.george-barwood.pwp.blueyonder.co.uk/DnsServer/NotesOnDNSSSEC.htm
>
>
thanks. Perhaps, it would be good to clarify this in the Clarifications
document ? (assuming there is consensus).

-mohan

> *From:* Sean Wells <[email-masked]>
> *To:* [email-masked]
> *Sent:* Friday, December 31, 2010 4:54 PM
> *Subject:* [dnsext] Checking RRSIG RR validity
>
> Hi,
>
> My question is with respect to the first two MUSTs: "MUST be the name of the zone" and "MUST be present in the zone's apex DNSKEY RRset". What does a validating stub resolver (that uses recursive query mode) expected to do for implementing these two MUSTs ?
>
> Thanks
>
> Sean
>
>  ------------------------------
>