Subject: Comment on draft-stjohns-secure-notify-00

From: Olivier Courtay <[email-masked]>
Date: Fri, 11 Jul 2003 16:07:47 +0200

Hi,

In the draft draft-stjohns-secure-notify-00,  update of the NS or DS is 
done by a NOTIFY signed by SIG(0).

The child send a signed NOTIFY Query with new RR and wait a response.

But the NOTIFY isn't crypted such anybody can see what the NOTIFY Query 
contains and forge a NOTIFY Response.
The child think that the change is done by his parent when it receives 
the fake Response but the parent doesn't update the delegation RR .

It's should have a security check somewhere, there are few possibilities :
    - the parent sign by SIG(0) the NOTIFY Response (on the same way of 
the draft)
    - the child check on the parent server that the change have been 
included (a simple (not signed) NOTIFY Response is sent by the parent).

The first solution have the advantage to be coherent with the NOTIFY 
Query, but the private key may not be on the server, and the NOTIFY 
Response is built when the zone is resigned, it could spent a long time 
between Query and Response.

The second solution have the advantage that the child verify that the 
change take effect on the parent's zone server.
This check can be done independently with reception of the NOTIFY Response.

-- 
Olivier COURTAY
Research engineer
IDsA Project (www.idsa.prd.fr)
ENST Bretagne( www.enst-bretagne.fr)

Gilles GUETTE
Ph.D student
Armor Project
Irisa/Inria (www.irisa.fr)

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>