Subject: [dnsext] Missing DNSKEY record

From: Sean Wells <[email-masked]>
Date: Mon, 15 Aug 2011 15:32:20 -0700

Hi,

As part of the DNSSEC validation, you lookup the DNSKEY record. If the
DNSKEY record is missing in the response and you receive a NSEC, you can't
do much because to validate NSEC, you need the key again. You can detect
this and abort i.e if you don't have a DNSKEY, abort the validation process
without processing the NSEC. Obviously, this could be part of an attack. But
aborting is still better than asking for keys again and again. I don't see
any text in RFC 4035 regarding this. Perhaps, dnssec-bis implementation can
mention this case ?

thanks
Sean
_______________________________________________
dnsext mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dnsext

---

From: Andrew Sullivan <[email-masked]>
Date: Mon, 15 Aug 2011 22:43:59 -0400

> any text in RFC 4035 regarding this. Perhaps, dnssec-bis implementation can

What would you have it say?  "If you are unable to validate a response
because you don't have adequate information, then . . ."?

I think the right answer is surely, "Bogus, return SERVFAIL", no?

A

-- 
Andrew Sullivan
[email-masked]

---

From: Sean Wells <[email-masked]>
Date: Mon, 15 Aug 2011 21:56:58 -0700

On Mon, Aug 15, 2011 at 7:43 PM, Andrew Sullivan <[email-masked]>wrote:

> In the validation process, it looks like handling a NSEC for DNSKEY is the
only odd one out. NSEC response for DS is well understood. I don't know what
implementations do when RRSIGs are missing.

I would just mention the odd case instead of generalizing: "If you are
unable to validate a response because you are not able to fetch DNSKEY
records, the validation process should be aborted".

>
> Sure. But do implementations return SERVFAIL today ? How do resolvers
handle this case ?

 -Sean

---

From: Mark Andrews <[email-masked]>
Date: Tue, 16 Aug 2011 22:06:45 +1000

> records, the validation process should be aborted".

Actually it isn't a immediate fail.  It's only a fail if the zone is supposed
to be treated as secure by the validator.  If the zone is insecure as far as
the validator is concerned then the answer is legitmate.
 
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]
_______________________________________________
dnsext mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dnsext

---

From: Sean Wells <[email-masked]>
Date: Tue, 16 Aug 2011 09:13:30 -0700

On Tue, Aug 16, 2011 at 5:06 AM, Mark Andrews <[email-masked]> wrote:

> > On Mon, Aug 15, 2011 at 7:43 PM, Andrew Sullivan <[email-masked]
> >wrot
> > e:
> >
> > > > without processing the NSEC. Obviously, this could be part of an
> attack.
> > > But
> > > > aborting is still better than asking for keys again and again. I
> don't
> > > see
> > > > any text in RFC 4035 regarding this. Perhaps, dnssec-bis
> implementation
> > > can
> > > > mention this case ?
> > >
The issue is not the legitimacy of the response itself. What should the
validator do if it can't lookup the DNSKEY record and it receives a NSEC in
response to it ?  Could you clarify as to what you mean by "it isn't a
immediate fail" ?