Subject: Re: [DNSOP] CDS/CDNSKEY RRSet authentication

From: Richard Lamb <[email-masked]>
Date: Tue, 1 Aug 2017 23:36:25 +0000

Good catch. Thanks for identifying this and making it signed by both.  -Rick

> -----Original Message-----
> From: DNSOP [mailto:[email-masked]] On Behalf Of Mark Andrews
> Sent: Saturday, July 29, 2017 5:39 PM
> To: Tony Finch <[email-masked]>
> Cc: [email-masked]
> Subject: Re: [DNSOP] CDS/CDNSKEY RRSet authentication
> 
> 
> In message <[email-masked]>,
> Tony Finch
>  writes:
> > I think I have spotted a lacuna or possibly erratum in RFC 7344.
> >
> > In section 4.1 bullet 2 it says:
> >
> >    o  Signer: MUST be signed with a key that is represented in both the
> >       current DNSKEY and DS RRsets, unless [unusual case]
> 
> It just means that signers that know about ksk/zsk have special rules for cds
> and cdnskey.  This is from BIND's dnssec-signzone and causes the cds and
> cdnskey rrsets to be signed with both ksk and zsk dnskeys.
> 
>                 } else if (set->type == dns_rdatatype_cds ||
>                            set->type == dns_rdatatype_cdnskey ||
>                            iszsk(key)) {
>

---

From: Tony Finch <[email-masked]>
Date: Wed, 2 Aug 2017 15:41:42 +0100

Mark Andrews <[email-masked]> wrote:
>
> The purpose was for the CDS/CDNSKEY tools to not have to fetch the
> current DNSKEY RRset to be able to validate the records provided they
> have a current KSK.

Oh, that's neat, thanks!

Having thought about it a bit more I understand why the draft says what it
does and why that makes sense.

It's difficult that KSK can mean four different and not necessarily
congruent things:

 1. keys with the SEP bit set

 2. keys that sign the DNSKEY RRset

 3. keys with digests in the DS RRset

 4. keys that are trust anchors

My understanding is that for a validator the SEP bit is irrelevant.

For 2 and 3 the distinction I needed is that the DS keys are the ones
authenticated by the parent; the signing of the DNSKEY RRset allows the
child to authenticate additional keys (i.e. ZSKs). But from the parent's
point of view what matters is that the RRset as a whole is signed by a
parentally authenticated key.

Tony.
-- 
f.anthony.n.finch  <[email-masked]>  http://dotat.at/  -  I xn--zr8h punycode
Tyne, Dogger, Fisher, German Bight: South or southwest 3 or 4, increasing 5 or
6, occasionally 7 later. Slight becoming moderate. Rain then showers. Moderate
or good.