Subject: Re: Same-signed keys

From: [email-masked]
Date: Fri, 22 Sep 2000 13:18:39 +1100

> On Wed, 20 Sep 2000 [email-masked] wrote:
> 
>>> I don't see why this situation is fundamentally different from all the
>>> other forms of potential infinite loops in DNS (eg, CNAME loops).  The
>>> traditional solution is a simple counter (RFC-1035, p43, last
>>> paragraph).  If the only issue here is preventing infinite loops, I
>>> don't think that either form of the "always shorter" rule is necessary
>>> or desirable.
>> 
>> 	Supporting looping at the same level helps with really large
>> 	zones or where very long lived keys are required as it can
>> 	reduce the amount of clear text available per key.
> 
> No it doesn't.  Having a keyset with multiple keys has this effect.  
> 
> Looping just doesn't work.  Think of it this way - at the zone apex,
> there's a KEY set and a SIG KEY set.  Unless this is a security root, the
> SIG KEY set must contain a signature from the parent.  A resolver should
> always attempt to verify that signature.  If this is a security root,
> there will be no parent signature, so the resolver should attempt to
> verify any self-generated signature for which it has a key that it
> implicitly trusts or has validated.  However, if has any keys that it has
> validated, it must have already validated the KEY set, and this is a
> pointless revalidation.
> 

	You are right.

	I actually think DNSSEC would be simpler is individual keys as
	opposed to key sets were signed.  It would definitely make key
	management easier.

	Mark

--
Mark Andrews, Nominum Inc.
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.