Subject: [dnsext] mandatory algorithms (was: Some more sinners... virginia.gov & onguardonline.gov)

From: Casey Deccio <[email-masked]>
Date: Wed, 7 Sep 2011 16:09:58 -0700

On Wed, Sep 7, 2011 at 11:37 AM, Casey Deccio <[email-masked]> wrote:

> I can see that dnssec-bis-updates-14 omits that and only requires that the
> DNSKEY RRset be signed only using algs from the DNSKEY RRset itself:
>
> http://tools.ietf.org/html/draft-ietf-dnsext-dnssec-bis-updates-14
>
> (Sec 5.11)
>
>
[including dnsext... feel free to move entirely, if appropriate]

Ahem.  Upon more careful examination I see that when you combine the
requirements that 1) all algorithms from the DS RRset must appear in the
DNSKEY RRset and that 2) all algorithms in the DNSKEY RRset must be used to
sign the DNSKEY RRset, you get that requirement that the DNSKEY RRset must
be signed using all algorithms appearing in the DS RRset.

That being said, there still seems to be something missing from
dnssec-bis-updates-14, section 5.11 .  The requirement that the DNSKEY RRset
be signed with all algorithms in the DS RRset is insufficient.  For example,
consider the following:

Parent zone contains:
DS with alg 5 and key tag 123
DS with alg 7 and key tag 456

Corresponding child zone contains:
DNSKEY with alg 5 and key tag 789
DNSKEY with alg 7 and key tag 456
RRSIG(DNSKEY) with alg 5 and key tag 789
RRSIG(DNSKEY) with alg 7 and key tag 456

This meets all the said requirements.  It also meets the requirements in RFC
4035, section 2.2, for which dnssec-bis-updates 5.11 was written.  And it
doesn't violate RFC 4035, section 2.4, which appropriately uses "SHOULD" to
describe how DS RRs should correspond to DNSKEYs.  But, it's insufficient
because a validator that understands algorithm 5 and not algorithm 7 will be
unable to complete a chain of trust.  Although the DNSKEY RRset has been
signed with alg 5, it has not been signed with a key with alg 5 that
corresponds to the DS RR.  Here's a more basic example (stripping out the
second algorithm) that clearly doesn't work:

Parent zone contains:
DS with alg 5 and key tag 123

Corresponding child zone contains:
DNSKEY with alg 5 and key tag 789
RRSIG(DNSKEY) with alg 5 and key tag 789

If I'm not missing another reference somewhere that fills this void, I would
suggest clarifying the wording, so that it's not simply algorithms that are
required, but also includes DS awareness.

Casey