Subject: Re: [DNSOP] I-D Action: draft-ietf-dnsop-dns-zone-digest-00.txt

From: "Wessels, Duane" <[email-masked]>
Date: Wed, 7 Aug 2019 23:29:01 +0000

Greetings DNSOP,

AFAICT there was no feedback received after this most recent version of the ZONEMD draft was posted.  As I mentioned before, there was one pretty significant change in that version:

> The most significant change is that multiple ZONEMD records are allowed.  The document recommends that multiple digests be present only when transitioning to a new digest type algorithm and has this to say about verification given multiple digests:
> 
> 4.1.  Verifying Multiple Digests
> 
>   If multiple digests are present in the zone, e.g., during an
>   algorithm rollover, at least one of the recipient's supported Digest
>   Type algorithms MUST verify the zone.
> 
>   It is RECOMMENDED that implementations maintain a (possibly
>   configurable) list of supported Digest Type algorithms ranked from
>   most to least preferred.  It is further RECOMMENDED that recipients
>   use only their most preferred algorithm that is present in the zone
>   for digest verification.
> 
>   As a matter of local policy, the recipient MAY require that all
>   supported and present Digest Type algorithms verify the zone.

We would like to have feedback on this change before progressing to working group last call.

DW

---

From: Bob Harold <[email-masked]>
Date: Thu, 8 Aug 2019 11:56:21 -0400

On Wed, Aug 7, 2019 at 7:29 PM Wessels, Duane <dwessels=
[email-masked]> wrote:

> Greetings DNSOP,
>
> AFAICT there was no feedback received after this most recent version of
> the ZONEMD draft was posted.  As I mentioned before, there was one pretty
> significant change in that version:
>
> > The most significant change is that multiple ZONEMD records are
> allowed.  The document recommends that multiple digests be present only
> when transitioning to a new digest type algorithm and has this to say about
> verification given multiple digests:
> >

Allowing multiple digests is good for algorithm rollovers.

It would be nice if the receiving end could warn (without failing) if it
did not recognize the new algorithm.
If the new algorithm was known but did not verify, I don't know whether to
pass or fail, but at least warn.
I don't see a good way to specify that, so it may be out of scope for the
draft.

Seems fine to me as written.

-- 
Bob Harold

---

From: Joe Abley <[email-masked]>
Date: Thu, 8 Aug 2019 12:49:29 -0400

Hi Duane,

> We would like to have feedback on this change before progressing to working group last call.

My suggestion is to focus on what is necessary for interop in the protocol and leave implementation decisions about the richness of local policy that can be configured to implementations. I don't think the RECOMMENDED paragraph is necessary (perhaps I'm missing something) and I think the final MAY paragraph is implicit and doesn't need to be spelled out. So my preference would be:

OLD:

NEW:

However, I don't think the two paragraphs I just casually removed do any harm, and I would not object if they were kept in.

Joe

---

From: "John Levine" <[email-masked]>
Date: 8 Aug 2019 14:51:55 -0400

I agree with Joe's advice to limit the spec to what you need to
interoperate.  It's a good idea to allow algorithm rollover, but I
don't think it's useful to try and guess how people might implement
it, or to try to invent a way to send back failure reports.

> Type algorithms MUST verify the zone.

I don't see how that's a MUST.  What else could you do?

> If multiple digests are present in the zone, it is up to the
> recipient to decide how many to check.  The zone digest is valid
> if at least one of the  digests can be verified.

R's,
John

---

From: Joe Abley <[email-masked]>
Date: Thu, 8 Aug 2019 12:36:00 -0700

> I don't see how that's a MUST.  What else could you do?

One alternative would be for the receiver to insist that all digests
with supported algorithms match. It seems reasonable to specify that
verifying that one of them matches is sufficient to declare the zone
intact.

I realise now that you mention it that that's not exactly what the
text says, but that's how I interpreted it earlier.

Joe

---

From: "John R Levine" <[email-masked]>
Date: 8 Aug 2019 15:56:40 -0400

> verifying that one of them matches is sufficient to declare the zone

If there are multiple digests and some validate and some don't, I can 
think of a whole lot of reasons why that might happen, e.g., bug at the 
signer, bug at the verifier, cosmic ray bit flip in one of the digests, 
MITM with a strange sense of humor.  I don't want to try to offer 
experience-free advice on how to debug that.

In realistic cases, unless there's a catastrophic break of one of the 
algorithms (so sensible verifiers will stop accepting it), if any of the 
digests verify, the chances are extremely high that the zone is good.

Regards,
John Levine, [email-masked], Taughannock Networks, Trumansburg NY
Please consider the environment before reading this e-mail. https://jl.ly

---

From: "Wessels, Duane" <[email-masked]>
Date: Thu, 8 Aug 2019 22:20:28 +0000

Thanks John and Joe, does this text capture what you're suggesting?

   If multiple digests are present in the zone, e.g., during an
   algorithm rollover, a match using any one of the recipient's
   supported Digest Type algorithms is sufficient to verify the zone.

DW

> On Aug 8, 2019, at 12:56 PM, John R Levine <[email-masked]> wrote:
> 
> If there are multiple digests and some validate and some don't, I can think of a whole lot of reasons why that might happen, e.g., bug at the signer, bug at the verifier, cosmic ray bit flip in one of the digests, MITM with a strange sense of humor.  I don't want to try to offer experience-free advice on how to debug that.
> 
> In realistic cases, unless there's a catastrophic break of one of the algorithms (so sensible verifiers will stop accepting it), if any of the digests verify, the chances are extremely high that the zone is good.
> 
> Regards,
> _______________________________________________
> DNSOP mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dnsop

---

From: "John R Levine" <[email-masked]>
Date: 8 Aug 2019 18:38:09 -0400

>   supported Digest Type algorithms is sufficient to verify the zone.

Looks good to me.

Regards,

---

From: Joe Abley <[email-masked]>
Date: Thu, 8 Aug 2019 15:46:30 -0700

>>  supported Digest Type algorithms is sufficient to verify the zone.

Me too!