Subject: Q: Is authenticated denial needed ??

From: Olafur Gudmundsson <[email-masked]>
Date: Tue, 27 Feb 2001 11:16:38 -0500

The working group needs to answer some hard questions, and I
would like them to be discussed before we start rewriting RFC2535.
This message is contains an introduction to the subject and the
first/biggest question.

Background:
When DNSSEC was designed there was perceived need to be able to
signal existence of names and types to prevent spoofing.
The NXT record is used to signal the existence or non existence
of a name and/or RR type. NXT are generally not liked but have been
considered "necessary evil" to protect the DNS. We have on the table
an alternate proposal that addresses many of the deficiencies in NXT.
The NO record has been designed as a alternative to NXT addressing the
drawbacks identified in NXT.

Advantages:
No spoofed data will be trusted if it is not substantiated by
NXT/NO records.

One of the nice side effects of NXT/NO records is that they can be used
to authenticate the existence  of delegations and if the parent has signed
key sets for the child. (A better solution would to have a real Delegation
record at the parent).

The NXT/NO can in theory be used for negative answer generation by caching
servers.

Spoofing attacks against DNS servers become harder.

Disadvantages:
Zones get larger, 1 more record set for each name in the zone,
in the case of NO double the number of names.

Negative answers still need SOA records in them for backward
compatibility.

Answers are larger as multiple NXT/NO records are needed in the
wild card case.

In many cases authoritative servers must be asked to get trusted
answer.

Authenticated denial of existence can be accomplished by asking a
authoritative server, either directly or via chain of trusted servers.

NXT and NO require ordering in DNS data bases and prevent efficient
lookups. NXT and NO require quite a bit of extra processing.

Alternatives to NXT/NO:
Signed/Authenticated answer from a Authorative server can be used to
derive enough information to determine that record/name does not exist.

The cost of TSIG without TKEY is astronomical, the cost with TKEY is high
and can become DOS attack on servers. The cost of SIG(0) is lower if there
are only few messages exchanged.
And of course this depends on nameservers having keys on line and
complicates DNSSEC validation process as keys of nameservers have to be 
validated as well as the name in question.

Question 1: Is authenticated denial NEEDED ?

If answer to 1 is yes
Question 2: Does NO have advantages over NXT that justify replacement
considerations?

If answer to 1 is maybe
Question 3: Should NXT/NO become experimental for now ?
(If yes this complicates DNSSEC resolver quite a bit).

One of the reasons for asking this questions now is to document the
why NXT/NO is included in DNSSEC.  I would like this debate to
conclude at the Minneapolis meeting.

	Olafur 

to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.

---

From: Bill Sommerfeld <[email-masked]>
Date: Wed, 28 Feb 2001 08:30:08 -0500

> Question 1: Is authenticated denial NEEDED ?

Yes.  

While it is impossible to guard against all denial-of-service attacks,
authenticated denial provides robustness against transient
denial-of-service attacks.

In the absence of authenticated denial, applications (such as MTA's)
which run "in background" without human intervention cannot take full
advantage of DNSSEC; they would either have to (a) treat all NXDOMAIN
responses as a "soft failure" (delaying notification to the end user,
perhaps for days, that they misaddressed time-critical email), or (b)
bounce mail when they get a NXDOMAIN (creating a vulnerability to a
transient denial-of-service).

> Question 2: Does NO have advantages over NXT that justify replacement

It appears to answer several of the common complaints about NXT.  I
think deployment considerations should prevail here -- if the choice
is between "NO" and either "no dnssec deployment for TLD's" or "no
authenticated denial", then we should go with "NO".

					- Bill