Subject: Re: Wildcards and Opt-In

From: David Hopwood <[email-masked]>
Date: Sat, 02 Feb 2002 03:14:36 +0000

-----BEGIN PGP SIGNED MESSAGE-----

Daniel Massey wrote:
> The use of wildcards in DNSSEC is somewhat awkward at best and
> I think it becomes a severe problem if Opt-In is used.
> 
> Suppose you have a entry such as:
>   *.edu. MX 10 mail.junk.edu
>   SIG by edu.
> 
> Now suppose a query for nge.isi.edu MX returns:
>    nge.isi.edu.  MX 10 mail.junk.edu
>    SIG by edu. (with label = 1)
> 
> Is this a valid answer or a response from an attacker?

It's invalid. To be valid, according to RFC2535, the response would
also need to prove that neither nge.isi.edu nor *.isi.edu are signed.
(If isi.edu does not exist, it can do that with a single signed
NXT.)

If the query was for foo.bar.nge.isi.edu, it would need to
prove that none of foo.bar.nge.isi.edu, *.bar.nge.isi.edu,
*.nge.isi.edu, or *.isi.edu are signed (again, if isi.edu does
not exist then this can be done with a single signed NXT).

An interesting case is what happens if isi.edu exists but
neither nge.isi.edu nor *.isi.edu does. Is the *.edu wildcard
supposed to be a valid match for nge.isi.edu in that case?
I don't think it should be, but I think I'm disagreeing with
RFC2535 about that:

#  Furthermore, if a wildcard expansion is returned in a response, in
#  general one or more NXTs needs to also be returned in the authority
               ^^^^^^^
#  section to prove that no more specific name (including possibly more
                                                ^^^^^^^^^^^^^^^^^^^^^^^
#  specific wildcards in the zone) existed on which the response should
   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
#  have been based.

I.e. what I think the resolver should require is a single NXT record that
proves that *nothing* under isi.edu (i.e. the domain one level more
specific than the wildcard entry) is signed:

   i.edu.    NXT j.edu NS KEY SOA  ; Opt-In
   i.edu.    SIG NXT 1 2 ( ;type-cov=NXT, alg=1, labels=2 ... )

where i.edu < isi.edu and isj.edu <= j.edu [sic]; as opposed to having to
possibly handle multiple NXT records proving that there are no wildcards
at each level.

- -- 
David Hopwood <[email-masked]>

Home page & PGP public key: http://www.users.zetnet.co.uk/hopwood/
RSA 2048-bit; fingerprint 71 8E A6 23 0E D3 4C E5  0F 69 8C D4 FA 66 15 01
Nothing in this message is intended to be legally binding. If I revoke a
public key but refuse to specify why, it is because the private key has been
seized under the Regulation of Investigatory Powers Act; see www.fipr.org/rip

to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: David Hopwood <[email-masked]>
Date: Sat, 02 Feb 2002 03:29:22 +0000

-----BEGIN PGP SIGNED MESSAGE-----

I wrote:
> where i.edu < isi.edu and isj.edu <= j.edu [sic];

Correction:

  where i.edu < isi.edu < j.edu, and j.edu is not a subdomain of isi.edu.

(isj.edu was supposed to be the next name in canonical order after
isi.edu that is not a subdomain of isi.edu, but it isn't, and the above
is a better way of expressing it).

- --