Subject: Re: Redux: Why I want to remove the null key (SIG)

From: Roy Arends <[email-masked]>
Date: Wed, 14 Jun 2000 15:39:06 +0200 (CEST)

On Fri, 9 Jun 2000, Edward Lewis wrote:

> In the parent zone:
> 
>          child    NS
>          child    KEY  null
>                   SIG  KEY ...
>                   NXT
>                   SIG  NXT
> 
> In the child zone:
> 
>          child    SOA
>                   SIG  SOA
>                   NS
>                   SIG  NS
>                   KEY
>                   SIG  KEY (signed by Mars Certification Agency)
>                   NXT
>                   SIG  NXT

The child zone is more authoritive than parent when it comes to
child-info.

As this child has a KEY, which is validated off-tree, a secure entrypoint
is defined here (as explained in our remarks on the
draft-ietf-dnsext-zone-status-01.txt). The resolver of interest for this
secure branch has the Mars Certification Agency KEY pre-configured and
knows that this is a secure entrypoint.  Therefore this secure resolver
can positively validate the SIG(KEY) at the child.

> This was legal under the policy in RFC 2535, section 6, but is not legal
> given the updating draft.

Which draft would this be ? 
  draft-ietf-dnsext-simple-secure-update-01.txt,
  draft-ietf-dnsext-signing-auth-01.txt or
  draft-ietf-dnsext-zone-status-01.txt. 

> According to 2535, the credibility of the
> child's KEY would force a "hiding" of the parent's NULL key, and
> certification chains would be formed to the certifying authority.  The
> Signing Authority does not account for off-tree certification, not at
> least until we understand it better.

According to 2535 there MUST be a NULL key signed by the parent in this
case. This is also needed to prevent denial of service for this
child for security aware resolvers, that are not preconfigured with
the Mars Certification Agency KEY and corresponding entry-points.  
Of course, for these resolvers, the child is seen as unsecured.

IMHO this doesn't say anything about the NULL key being a bad idea.

--roy & ted

to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.

---

From: Edward Lewis <[email-masked]>
Date: Fri, 23 Jun 2000 12:44:52 -0400

>can positively validate the SIG(KEY) at the child.

This assumes that all of the resolvers-of-interest are so configured.  The
problem is that for all other resolvers, this is a misconfiguration.

>  draft-ietf-dnsext-zone-status-01.txt.

#2 - signing-auth

>IMHO this doesn't say anything about the NULL key being a bad idea.

The "bad idea" is that although the parent has properly issued a NULL key,
the NULL key is not available (hidden).  OTOH, if the indication were in
the NXT record (current proposal is using the OPT record bit - we'll argue
that later), then the parent can still signal that it thinks the child is
unsecured.

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                                NAI Labs
Phone: +1 443-259-2352                      Email: [email-masked]

"It takes years of training to know when to do nothing" - Dogbert

Opinions expressed are property of my evil twin, not my employer.