Subject: RE: prohibiting use of expired RRSIGs

From: "Loomis, Rip" <[email-masked]>
Date: Mon, 26 Jan 2004 11:36:51 -0500

Various people had written:
> >>MAY be configurable as to whether to accept expired records.  If
> >>configurable,  SHOULD be
> >>configurable to as to the maximum out of date expired 
> records can be to be
> >>acceptable.  And if configurable, MUST default to not 
> accepting expired
> >>records.
> > 
> > 
> > Much better, but this loses the main sentiment of the original,
> > namely that one MUST NOT or SHOULD NOT use out-of-date (expired or
> > not yet active) RRSIGs.  The text above would allow a 
> > non-configurable resolver to accept out-of-date records.
> 
> Allowing an insecure option is not appropriate.
> 
> If a protocol is allowed to be operated with less security, most
> people will do so and still believes they have advertised (full)
> security.

Ohta-san:
During the transition from DNS-today to DNS-with-signed-zones, many
compromises need to be made that allow for configurability without
denying DNS to users.  The challenge is doing that in a way that
does not lead to long-term security issues with DNSSEC.  However, 
in this case Mike StJohns correctly stated an issue with the language.
If Sam revises his language appropriately then that would lead to a
workable solution that does not detract from security.

Are you sure that you're actually reading the e-mails, rather than
just responding to a perceived opportunity to denigrate DNSSEC?

> It seems to me that the problem is that people recognizes it
> essentially impossible to deploy DNSSEC.

It seems to me that it is not "essentially impossible to deploy
DNSSEC".  It seems to me that there will be some effort required,
and I'm not sure that we have all the answers yet--but saying
"it's too hard" isn't the best solution to most problems in my
personal experience.

Do you believe that the postulated threats against DNS (which
DNSSEC was designed to address) are not realistic?  If so, then
that would be an...interesting...opinion to me.

  --Rip

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Masataka Ohta <[email-masked]>
Date: Tue, 27 Jan 2004 06:51:23 +0900

Rip;

>>>>MAY be configurable as to whether to accept expired records.  If configurable,  SHOULD be
>>>>configurable to as to the maximum out of date expired records can be to be
>>>>acceptable.  And if configurable, MUST default to not accepting expired
>>>>records.

> does not lead to long-term security issues with DNSSEC.

OK.

>  However, 

The statement above says nothing about "long-term".

Regardless of whatever is the default, configuration to accept
expired records will be used widely forever.

That DNSSEC needs a lot of configuration means that, during the
configuration, administrators are tempted to change some of
the default to reduce the rest of the configuration effort.

> just responding to a perceived opportunity to denigrate DNSSEC?

You don't read the e-mails literally and assuming impractical
assumptions.

> "it's too hard" isn't the best solution to most problems in my

Introducing options means you recognize "it's too hard".

> that would be an...interesting...opinion to me.

Just before the previous meeting, I posted a solution for small
message ID space, though I don't expect you read it.

Othere threats are as realistic as DNSSEC zones with compromized
keys or DNSSEC resolvers with faked root public keys (or their
signatures).

							Masataka Ohta