Subject: [DNSOP] I-D Action: draft-ietf-dnsop-dns-zone-digest-00.txt

From: [email-masked]
Date: Mon, 24 Jun 2019 00:04:41 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Domain Name System Operations WG of the IETF.

        Title           : Message Digest for DNS Zones
        Authors         : Duane Wessels
                          Piet Barber
                          Matt Weinberg
                          Warren Kumari
                          Wes Hardaker
	Filename        : draft-ietf-dnsop-dns-zone-digest-00.txt
	Pages           : 29
	Date            : 2019-06-23

Abstract:
   This document describes an experimental protocol and new DNS Resource
   Record that can be used to provide a message digest over DNS zone
   data.  The ZONEMD Resource Record conveys the message digest data in
   the zone itself.  When a zone publisher includes an ZONEMD record,
   recipients can verify the zone contents for accuracy and
   completeness.  This provides assurance that received zone data
   matches published data, regardless of how the zone data has been
   transmitted and received.

   ZONEMD is not designed to replace DNSSEC.  Whereas DNSSEC protects
   individual RRSets (DNS data with fine granularity), ZONEMD protects
   protects a zone's data as a whole, whether consumed by authoritative
   name servers, recursive name servers, or any other applications.

   As specified at this time, ZONEMD is not designed for use in large,
   dynamic zones due to the time and resources required for digest
   calculation.  The ZONEMD record described in this document includes
   fields reserved for future work to support large, dynamic zones.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-dnsop-dns-zone-digest/

There are also htmlized versions available at:
https://tools.ietf.org/html/draft-ietf-dnsop-dns-zone-digest-00
https://datatracker.ietf.org/doc/html/draft-ietf-dnsop-dns-zone-digest-00

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: "Wessels, Duane" <[email-masked]>
Date: Mon, 24 Jun 2019 07:22:29 +0000

DNSOP,

Here's a summary of the changes since the previous version:

   From -06 to -07:

   o  Fixed mistakes in ZONEMD examples.

   o  Added private use Digest Type values 240-254.

   o  Clarified that Digest field must not be empty.

   From -07 to draft-ietf-dnsop-dns-zone-digest-00:

   o  Adopted by dnsop.

   o  Clarified further that non-apex ZONEMD RRs have no meaning.

   o  Changed "provably [un]signed" to "provably [in]secure".

   o  Allow multiple ZONEMD RRs to support algorithm agility/rollovers.

   o  Describe verification when there are multiple ZONEMD RRs.

I'm also attaching an rfcdiff since this version isn't linked to the pre-adoption version.

The most significant change is that multiple ZONEMD records are allowed.  The document recommends that multiple digests be present only when transitioning to a new digest type algorithm and has this to say about verification given multiple digests:

4.1.  Verifying Multiple Digests

   If multiple digests are present in the zone, e.g., during an
   algorithm rollover, at least one of the recipient's supported Digest
   Type algorithms MUST verify the zone.

   It is RECOMMENDED that implementations maintain a (possibly
   configurable) list of supported Digest Type algorithms ranked from
   most to least preferred.  It is further RECOMMENDED that recipients
   use only their most preferred algorithm that is present in the zone
   for digest verification.

   As a matter of local policy, the recipient MAY require that all
   supported and present Digest Type algorithms verify the zone.

DW

> On Jun 24, 2019, at 8:04 AM, [email-masked] wrote:
> 
> 
> _______________________________________________
> DNSOP mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dnsop