Subject: secondary behavior with DNSSEC

From: Miek Gieben <[email-masked]>
Date: Thu, 20 Mar 2003 10:48:46 +0100

Hello,

during our SECREG experiment (secreg.nlnetlabs.nl) we are seeing to following
problem:

One of the secondaries for the signed .nl zone has not been updated for some
time now. The signatures it carries are expired on March 10. This means that
whoever was using this server only gets bad (authoritative) data for .nl.
If this was for real .nl would have dropped of the earth for all user of this
nameserver.

This difference with DNS is obvious, with DNS a secondary that was not up to
date was bad, but it was still sort of usable. With DNSSEC a secondary that is
longer out of date than the signature lifetime is disastrous - it causes the
local removal of a TLD (in this case).

To put it another way: DNSSEC introduces a clock to the DNS operation, and
the clock ticks every signature lifetime,

grtz  Miek

--
:wq!
#----------------------------------------------------------------------
# To unsubscribe, send a message to <[email-masked]>.

---

From: bert hubert <[email-masked]>
Date: Thu, 20 Mar 2003 13:54:58 +0100

> local removal of a TLD (in this case).

I also see interesting DoS possibilities here - DNSSEC does not offer any
additional protection against spoofing, except that cached answers will be
recognized as being spoofed, but only by DNSSEC aware clients and not by
generic recursors. 

So by spoofing in a badly signed NL NS record, the TLD vanishes for all
secure clients of that poisoned recursor.

Which underlines one of my remaining problems with DNSSEC, even though it
now appears that great progress is being made towards usability. I wonder
how many operators will continue to use DNSSEC after the first time they
notice that it hampers the uptime of their services because of problems like
the above.

Regards,

bert

-- 
http://www.PowerDNS.com      Open source, database driven DNS Software 
http://lartc.org           Linux Advanced Routing & Traffic Control HOWTO
http://netherlabs.nl                         Consulting
#----------------------------------------------------------------------
# To unsubscribe, send a message to <[email-masked]>.

---

From: Miek Gieben <[email-masked]>
Date: Thu, 20 Mar 2003 14:12:22 +0100

[On 20 Mar, @13:54, bert wrote in "Re: secondary behavior with DN ..."]
> secure clients of that poisoned recursor.

This is already known, if a secure resolver sits behind a non-secure recursor
you'r on your own. 

grtz  Miek