Subject: RE: Summary: DNSEXT WGLC: To OPT-IN or not to OPT_IN

From: Roy Arends <[email-masked]>
Date: Wed, 30 Apr 2003 16:56:47 +0200 (CEST)

On Wed, 30 Apr 2003, Sam Weiler wrote:

> There's also the deletion ("spoof a zone out of existence") attack.

Sam, when you use Opt-In, the domain that is 'skipped' using NXT is not
secured.  Its part of the definition, similarly: an unlocked door can be
opened. Don't blame the lock. Blame the policy for the door.

Protection against your deletion ("spoof a zone out of existence") attack:
sign the delegated zone.

A secured delegation to an unsecured zone is as practical as an unsecured
delegation.

Roy

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Daniel Massey <[email-masked]>
Date: Wed, 30 Apr 2003 11:19:40 -0400

On Wednesday, April 30, 2003, at 10:15  AM, Sam Weiler wrote:

> On Wed, 30 Apr 2003, Hallam-Baker, Phillip wrote:
>>
>> 	What value do you claim there is to securing the delegation without
>> any security on the delegated zone?
>>
>> 	There has been a lot of security analysis on this issue, the only
>> security issue that has been raised is that of preventing an insertion
>> attack, a risk that is not relevant to a domain where anyone can buy a
>> domain.
>
> You can still replace the NS and make the zone unreachable, but you
> could have done that just by stomping on the whole answer; DNSSEC
> doesn't guarantee that packets get through.  Without opt-in, assuming
> you get an answer at all, you at least get a verifiable statement of
> existence -- you know that such a delegation exists and that something
> is preventing you from reaching it.  That could trigger an IDS's alarm
> bells, or it could tell you that you need to try harder to get the
> answer.
>

This has always seemed like nothing more than smoke and mirrors to me.

If I want to delete a zone  without opt-in,  I will send the valid NXT 
RR proving that the zone is not signed and I will make up any NS 
records of my choosing.   As Roy points out, security has ended at this 
point so all bets are off.  I don't see how the signed NXT RR has 
bought you anything here.

If I want to delete a zone with opt-in, I will send the valid NXT RR 
proving the range containing that zone is not signed  (and will 
optionally make up any NS records of my choosing or just say no zone).

I think you start to point out the tip of the iceberg:  if I can 
convince some IDS to do a look of work trying to check unsecure zones 
that can (by definition) never be authenticated,  then I believe I will 
have lots of fun making your IDS do a variety of bad things.   Good 
luck to your IDS design :)

Dan

> Assuming that methods for "trying harder" are developed, you probably
> don't want clients trying them all the time -- they'll probably be
> bandwidth intensive or they'll try to get around caches and end up
> pounding authoritative servers into the ground.  As an operator of
> authoritative servers, your employer may be interested in minimizing
> those events.  One way of doing that is to provide a very clear
> trigger for when it's required.  You don't want all NXDOMAINS to turn
> into a "flail on the auth servers" fest.
>
> -- Sam
>
>
> --