Subject: Re: [dnsext] Historical root keys: The Large Router Vendor Speaks

From: Tony Finch <[email-masked]>
Date: Tue, 1 Feb 2011 16:25:05 +0000

On Fri, 28 Jan 2011, George Barwood wrote:
>
> I think it's necessary to roll the key eventually because DNSSEC
> signature dates wrap, (and signatures can therefore be replayed) but
> only after 136 years.

There are no dates on DNS keys so I don't understand the relevance of this
point.

Tony.
-- 
f.anthony.n.finch  <[email-masked]>  http://dotat.at/
HUMBER THAMES DOVER WIGHT PORTLAND: NORTH BACKING WEST OR NORTHWEST, 5 TO 7,
DECREASING 4 OR 5, OCCASIONALLY 6 LATER IN HUMBER AND THAMES. MODERATE OR
ROUGH. RAIN THEN FAIR. GOOD.

---

From: Chris Thompson <[email-masked]>
Date: 01 Feb 2011 16:49:19 +0000

>There are no dates on DNS keys so I don't understand the relevance of this

In 2011, the root zone has an RRSIG on the DNSKEY RRset signed using the KSK,
validating the current ZSK. It covers a period of a couple of weeks.

In 2147, the same time_t values (mod 2^32) come round again, and this RRSIG
can be replayed, if the root zone KSK has not changed.

Meanwhile, this year's ZSK has been compromised - we'll be able to factorise
1024-bit moduli by then, surely?

So the replay can be used to validate a compromised root zone ZSK, and we're
well away to taking over the Internet :-)

Of course, the likelihood of any of this stuff being around in 136 years time
is ... small.

-- 
Chris Thompson               University of Cambridge Computing Service,
Email: [email-masked]    New Museums Site, Cambridge CB2 3QH,
Phone: +44 1223 334715       United Kingdom.

---

From: "George Barwood" <[email-masked]>
Date: Tue, 1 Feb 2011 16:50:49 -0000

----- Original Message ----- 
From: "Tony Finch" <[email-masked]>
To: "George Barwood" <[email-masked]>
Cc: <[email-masked]>
Sent: Tuesday, February 01, 2011 4:25 PM
Subject: Re: [dnsext] Historical root keys: The Large Router Vendor Speaks

> There are no dates on DNS keys so I don't understand the relevance of this

Ok, we are talking about replay attacks.

The date fields in RRSIG records wrap around after 136 years,  so an attacker
can replay responses from 136 years ago and they will be accepted as current,
if no KSK rollover has been performed.

Thus in DNSSEC, you must roll any KSK at least once every 136 years to remain secure.

( 136 years = 2^32 seconds )

George

---

From: Tony Finch <[email-masked]>
Date: Tue, 1 Feb 2011 16:54:55 +0000

> can be replayed, if the root zone KSK has not changed.

Ah, of course! Thanks.

Tony.

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Tue, 1 Feb 2011 12:00:36 -0500

> Of course, the likelihood of any of this stuff being around in 136 years

The likelihood of us being around is small. But the system itself will
almost certainly still be around.

About 60% of the light fixtures in my house in the US suffer from a fairly
elementary design flaw that was corrected in the European standard fixture
(the Swan bayonet)  over a century ago. As a result they have a tendency to
work loose under vibration.

The design considerations of the QWERTY keyboard have been known as long.
But I am typing on one right now.

Make still has a peculiar syntax glitch that the designer thought they
should have fixed the day after the first release but could not because
there was an installed base that objected to the change.

Once this infrastructure is deployed it is going to only be possible to
add.

Fortunately any given piece of equipment need only need install the most
recent root. So unless we expect physical equipment to have to last more
than 136 years we can work fine with a system where roots are valid for 25
years and a new one is published every five years.

Given that RSA1024 is about to be deprecated, this is really only an issue
for RSA2048.

-- 
Website: http://hallambaker.com/

---

From: Olafur Gudmundsson <[email-masked]>
Date: Tue, 01 Feb 2011 14:12:27 -0500

On 01/02/2011 11:50 AM, George Barwood wrote:
> From: "Tony Finch"<[email-masked]>
> To: "George Barwood"<[email-masked]>
> Cc:<[email-masked]>

Actually there is no explicit requirement to roll, you need signatures 
to be included that show the key has not changed every 34 years or so, 
as validators are supposed to only accept timer values that are not that 
far off each other (there are times I wish we had gone with at least 40 
bit timer values).

	Olafur