Subject: DNSEXT WGLC: DS SHA-256

From: Ólafur Guðmundsson<[email-masked]>
Date: Wed, 14 Dec 2005 10:01:36 -0500

This message starts a Working Group Last Call on following document
http://www.ietf.org/internet-drafts/draft-ietf-dnsext-ds-sha256-02.txt

The last call is scheduled to end on December 31'st 2005.

This document defines a new digest algorithm for the DS record.
The reason why this is needed is the degrading trust in SHA-1
algorithm currently used.

The document is on standards track and is scheduled to be published as
Proposed Standard.

Please read this document and send statements of support/issues to
the namedroppers mailing list or chairs.
The chairs require that at least 5 people review and support this document.

	Olafur & Olaf 	

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: "Stuart E. Schechter" <[email-masked]>
Date: Wed, 21 Dec 2005 09:42:52 -0500

I have reviewed and support this document.

   As for whether a validator SHOULD or MUST ignore SHA1 digests when
SHA-256 are present, perhaps the "security considerations" section could
discuss the downgrade attack on validators that accept SHA1 digests when
SHA-256 digests are present?

   Should the pair of colons following "The DNSKEY Record" in 2.3 be one
colon, or is this an IETF convention with which I as a newbie am unfamiliar?

   One very minor editing nit-pick -- the words "of course" in the security
considerations are superfluous and distracting.  This isn't a show stopper
and I'm fine if Wes doesn't want to change it.  I just feel that if we truly
believed the statement was obvious to all possible readers it wouldn't be
worth including.  Putting the "of course" only makes things harder to read.

   Best

   Stuart

> From: Ólafur Gu›mundsson <[email-masked]>
> Date: Wed, 14 Dec 2005 10:01:36 -0500
> To: <[email-masked]>
> Subject: DNSEXT WGLC: DS SHA-256
> 
>

---

From: Wes Hardaker <[email-masked]>
Date: Mon, 26 Dec 2005 12:34:46 -0800

>>>>> On Wed, 21 Dec 2005 09:42:52 -0500, "Stuart E. Schechter" <[email-masked]> said:

Stuart> Should the pair of colons following "The DNSKEY Record" in 2.3
Stuart> be one colon, or is this an IETF convention with which I as a
Stuart> newbie am unfamiliar?

nope, it's a typo.  fixed.

Stuart> One very minor editing nit-pick -- the words "of course" in
Stuart> the security considerations are superfluous and distracting.

I (at least) agree.  Removed.

-- 
Wes Hardaker
Sparta, Inc.

---

From: Wes Hardaker <[email-masked]>
Date: Mon, 26 Dec 2005 12:49:29 -0800

>>>>> On Wed, 21 Dec 2005 09:42:52 -0500, "Stuart E. Schechter" <[email-masked]> said:

Stuart> As for whether a validator SHOULD or MUST ignore SHA1 digests
Stuart> when SHA-256 are present, perhaps the "security
Stuart> considerations" section could discuss the downgrade attack on
Stuart> validators that accept SHA1 digests when SHA-256 digests are
Stuart> present?

Something like the following would-be-new paragraph:?

  If algorithms of different perceived strengths are both used, and
  if validators allow for either to indicate that the child zone's
  DNSKEY is the one being referred to then downgrade attacks are
  possible.  For example, if the following conditions are all true:

     - Both SHA-1 and SHA-256 based digests are published in DS
       records within a parent zone for a given child zone's DNSKEY.
     - The DS record with the SHA-1 digest matches the digest
       computed using the child zone's DNSKEY.
     - The DS record with the SHA-256 digest fails to match the
       signature computed using the child zone's DNSKEY

  Then if the validator accepts the above situation as secure then
  this can be used as a downgrade attack since the stronger SHA-256
  digest is ignored.

I won't insert it, however, unless there are other WG members that
agree it is sufficient and needed.  I suspect there will be support
for something like this though.
-- 
Wes Hardaker
Sparta, Inc.