Subject: Re: I-D ACTION:draft-ietf-dnsext-ad-is-secure-03.txt

From: Brian Wellington <[email-masked]>
Date: Wed, 25 Jul 2001 11:05:18 -0700

On Wed, 25 Jul 2001, Ted Lindgreen wrote:

> [Quoting Brian Wellington, on Jul 25,  0:32, in "Re: I-D ACTION:draft ..."]
>
> > This is not a BIND issue.  It's a fundamental problem that DNSSEC
> > verification is slow, and the authoritative server should not be doing it.
>
> I do not think that many people on this list agree with this statement.

Given that the people who care about DNSSEC are an incredibly small
fraction of the total users of DNS, and verify-on-query will slow
everything down, someone needs to speak up for them.  Authoritative name
servers should be handing out data.  That's it.

> The main question was:
> When an authorative nameserver sets the AD, is it then:
> - A MUST that the nameserver software makes sure the data is sane?
> - Is it sufficient to rely on the fact that the data comes from disk
>   and that the sysadm has taken care of putting valid data there
>   and always refreshing the sigs in time?
>
> I think many of us, especially those with operational experience
> in large scale production environments, think that the latter is
> not sufficient.  Further, I personaly think that not setting the
> AD bit and splitting functionality of authorative and caching
> servers are just workarounds.

Does an authoritative server sanity check anything else?  Does it check
that your A records point to the correct address?  Or that your
delegations are sane?  No.  It checks structural validity for all records.
Why should SIGs be any different?

> If efficiency is a big issue, I think that everybody can very well
> live with more efficient procedures than a verify on each and every
> query, like a one-time verify on startup, reload and AXFR, plus a
> timer to prevent unnoticed sigexpires. I don't think that many
> people will agree that just omitting all sanity checks are the
> solution to efficiency problems.

That's still not efficient.  Anything involving verification at query time
could cause the first query to time out while the data is being validated,
which will make users unhappy.  Adding timers also doesn't scale to large
zones, especially large zones with incremental updates.

> > I'm confused as to how "almost everyone" agrees with this.  From what I
> > can tell, there are about 5 people participating in this discussion, and
> > only 3 are in favor of this.
>
> Indeed, in the last discussion only 5 people spoke up, but this
> issue is not new. It has been a topic on at least 4 IETF meetings,
> 4 RIPE meetings, other (ccTLD) meetings and conferences, and more
> DNSSEC workshops than I can remember exactly how many.
>
> Sofar, almost everybody I heard about this issue, had the opinion,
> that secure aware nameservers, including and especially authorative
> nameservers, should be careful not to produce data with bad and/or
> expired sigantures. During the various workshops, everybody, without
> exception, was amazed, to say it mildly, on finding out that BIND-9
> does not do any checking on the data it's authorative for and
> starts up and happliy answers with outdated SIGs.
>
> My statement "almost everyone" was based on this experience.  But,
> my remark, that the current software, BIND-9, does not do any sanity
> check on SIGs, while the former BIND-8 release did a resonable job
> here, is an implementation issue and indeed off-topic on this list,
> for which I apologise.

I don't remember this coming up at any IETFs that I've been to (I've only
missed 1 recently) or the DNSSEC workshops I've attended, or the RIPE
meeting, but I'll take your word for it.

Brian

to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.

---

From: Mark Kosters <[email-masked]>
Date: Wed, 25 Jul 2001 14:39:57 -0700

> servers should be handing out data.  That's it.

Just so Brian does not feel alone, I wince in pain thinking that the gtld 
or root servers (or any other high query rate authoritative server) would 
have to perform verify-on-query.

Mark

---

From: Edward Lewis <[email-masked]>
Date: Wed, 25 Jul 2001 15:10:50 -0700

>have to perform verify-on-query.

Everyone does (the wince in pain thing).

The two arguments are over the definition of the AD bit setting and that
there is a desire to have an option to do verify-on-query.  As Brian has
stated that he thinks his words are sufficient as is, I'll try to submit
some alternate text that is in line with an understanding generated at a
recent workshop.

The differences of opinion are slight, but the fact that so many of us were
able to derive a coherently different meaning from Brian's text concerns
me.  My position is that the text needs to be tightened.

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                                NAI Labs
Phone: +1 443-259-2352                      Email: [email-masked]

You fly too often when ... the airport taxi is on speed-dial.

Opinions expressed are property of my evil twin, not my employer.

---

From: Randy Bush <[email-masked]>
Date: Wed, 25 Jul 2001 15:11:05 -0700

> fraction of the total users of DNS

until the first major attack.  and six months from then, being able to
efficiently handle heavily mixed modes will be useful.

and that attack will come.

randy