Subject: [DNSOP] Ghost of a zone signature effort from the long ago days...

From: Edward Lewis <[email-masked]>
Date: Tue, 31 Jul 2018 17:51:42 +0000

I hear there are proposals to sign the entire contents of zones. zonemd/xhash in some subject lines.

(Forgive me if SIG(AXFR) was mentioned before...)

"Domain Name System Security Extensions", a'la RFC 2065, section 4.1.3 Zone Transfer (AXFR) SIG:

"However, to efficiently
   assure the completeness and security of zone transfers, a SIG RR
   owned by the zone name must be created with a type covered of AXFR
   that covers all zone signed RRs in the zone and their zone SIGs but
   not the SIG AXFR itself."

"Domain Name System Security Extensions", a'la RFC 2535, Appendix B: Changes from RFC 2065:

"3. ...In addition, the SIG covering type AXFR has been
      eliminated..."

I wish I could recall why.  (Anyone else recall why this was dropped?  I recall realizing it was a fool's errand but not the reasons.)  Yes, today's network is different.

I would think, if there is concern that the glue records were a mucked-with and a validator were misdirected by malicious glue, the DS record would provide evidence of a redirection.  For unsigned delegations, this would be an incentive to sign, for non-validating resolvers, an incentive to validate.

Now, pushing for universal deployment of DNSSEC might be improper at this juncture.

The option is to develop, implement, and operate a way to "sign the contents of a zone."  (Especially considering the pushback on full DNSSEC deployment.)

History isn't always the guide to follow, but we tried this once and gave up.

(Note: no comment on the merits of zonemd/xhash, just throwing in some history.)

---

From: "Wessels, Duane" <[email-masked]>
Date: Tue, 31 Jul 2018 19:25:40 +0000

> On Jul 31, 2018, at 10:51 AM, Edward Lewis <[email-masked]> wrote:
> 

Olafur wrote a little about this a couple weeks ago.  He said:

"Historical background: SIG(AXFR) was rejected because it required putting the zone into canonical order and calculating the signature, in the case of dynamic update this is a real expensive operation, thus we got rid of it."

I have been looking at solutions to this problem, and have been implementing them in my proof-of-concept ZONEMD code.

DW