Subject: Re: comments on nsec3-01

From: [email-masked] (Ted Lindgreen)
Date: Tue, 1 Mar 2005 14:42:25 +0100

[Quoting Roy Arends, on Mar  1, 14:11, in "Re: comments on nsec ..."]

Roy,

I'm not sure I fully understand what you are saying, but I read
from your argumentation:

> Firstly, lets agree that changing the hash-function field value inside the
> NSEC3 requires re-signing the record. If an adversary changes the
> hash-function field value without re-signing, the verification of the
> RR will fail .....

that it leads to:

> Basically, there are three mayor effects:
> 
> 1) negative responses (i.e. no such name, no such type) will deem invalid.
> (for argument sake, this includes responses due to wildcard expansions).
> 
> 2) positive responses can be replaced by any negative response from the
> same zone. Because the hash-function is not known, QNAME can not be
> checked against the interval.
> 
> 3) the status of delegation points is unknown, since the interval of the
> related NSEC3 RR can not be checked, hence, the DS bit status is not
> valid.

which then translates into:

> The most destructive action an adversary can mount at this point is a
> denial of service.

If I understand this correctly, then this expands to:

 We don't really need the authenticated denial of existance machinery
 at all, as the most destructive action is a DOS.

If this were true, then we could do away with NSEC altogether, but
I'm affraid it isn't true as there was (and still is, I think) broad
consensus that authenticated denial of existance is an essential
part of DNSSEC.

Regards,
-- ted

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Roy Arends <[email-masked]>
Date: Tue, 1 Mar 2005 15:06:35 +0100 (CET)

> > hash-function field value without re-signing, the verification of the

Nope.

The 'firstly' and 'secondly' I wrote simply makes the resolution fatal. I
explicitly say that.

Then I continue and argue the effect of usage of unknown values for the
hash-function field in the nsec3 RDATA.

> > The most destructive action an adversary can mount at this point is a

'zactly.

>  at all, as the most destructive action is a DOS.

Nope. Not at all. You're jumping to the wrong conclusion.

Let me rephrase that so you might understand what was between the lines:

The most destructive action an adversary can mount at this point is a
denial of service, as opposed to altering a response in such a way that a
resolver now regards data as 'cryptographically not secured'

> If this were true,

Which is not. Please re-read my message.

Roy