Subject: Re: Proposal to fix NSEC

From: Andras Salamon <[email-masked]>
Date: Tue, 1 Jun 2004 08:18:10 +0200

On Mon, 31 May 2004, Ted Lindgreen wrote:
> So, I think that the working group should NOT delay DNSSECbis by
> trying to fold in NSEC2 this late in the process. If NSEC2 needs
> to be worked out it should be done in a separate track.

Agreed.

-- Andras Salamon                   [email-masked]

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Ben Laurie <[email-masked]>
Date: Tue, 01 Jun 2004 11:34:52 +0100

> to be worked out it should be done in a separate track.

If we follow this path, it still leaves two options open at this stage, 
AFAICS:

a) Add some kind of version indication to something so that NSEC2 can be 
folded in later and not break deployed code (beyond the obvious breakage 
if it no longer understanding the response, of course).

b) Assume that NSEC2 will somehow find a way within the DNSSECbis docset 
to migrate without change to DNSSECbis.

I actually am still of the view that if nameservers suddenly started 
returning NSEC2 instead of NSEC things would work as desired: namely old 
resolvers would suddenly get protocol errors instead of NXDOMAIN, and 
new resolvers would just work.

If this causes bad things to happen, then DNSSECbis is already broken, 
since an attacker can clearly cause NSEC records to be corrupt.

Cheers,

Ben.

-- 
http://www.apache-ssl.org/ben.html       http://www.thebunker.net/

"There is no limit to what a man can do or how far he can go if he
doesn't mind who gets the credit." - Robert Woodruff

---

From: Chris Thompson <[email-masked]>
Date: Tue, 1 Jun 2004 12:11:10 +0100 (BST)

[email-masked] (Ben Laurie) writes:
[...]
> since an attacker can clearly cause NSEC records to be corrupt.

Define "bad". DNSSEC has never been proof against DoS attacks that make 
it unable to answer questions (as opposed to answer them incorrectly).
That doesn't mean that a protocol change that would simulate the effect
of a DoS attack would be a desirable thing to advocate.

Chris Thompson
Email: [email-masked]

---

From: Paul Vixie <[email-masked]>
Date: Tue, 01 Jun 2004 14:20:46 +0000

> ...
> ...
> b) Assume that NSEC2 will somehow find a way within the DNSSECbis docset to
> migrate without change to DNSSECbis.

i'm writing up a proposal to this effect in the xterm next to this one.

> resolvers would suddenly get protocol errors instead of NXDOMAIN, and new
> resolvers would just work.

that would be a downgrade attack, launched by a zone owner against herself,
and would only be of interest to zone owners who had not previously
implemented dnssec-bis.  let's do better.  i know several ways to do better.

---

From: Ben Laurie <[email-masked]>
Date: Tue, 01 Jun 2004 16:56:22 +0100

> of a DoS attack would be a desirable thing to advocate.

I certainly agree that if we could do better, we should.

Cheers,

Ben.

---

From: Edward Lewis <[email-masked]>
Date: Tue, 1 Jun 2004 13:44:42 -0400

At 11:34 +0100 6/1/04, Ben Laurie wrote:
>If this causes bad things to happen, then DNSSECbis is already broken, since
>an attacker can clearly cause NSEC records to be corrupt.

In what way (corrupt)?  NSEC records are signed, I think.  A wrong 
NSEC (not-germane, I used to say) may be inserted, but the verifier 
ought to toss it before waiting for the real one.

-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                            +1-703-227-9854
ARIN Research Engineer

Even the voices inside my head are refusing to talk to me anymore.

---

From: Ben Laurie <[email-masked]>
Date: Wed, 02 Jun 2004 12:16:53 +0100

Edward Lewis wrote:

>> since
> In what way (corrupt)?  NSEC records are signed, I think.  A wrong NSEC 
> (not-germane, I used to say) may be inserted, but the verifier ought to 
> toss it before waiting for the real one.

Apologies, just got back from Toronto and jetlag has clearly fried my 
brain: you are correct.

Cheers,

Ben.