Subject: Re: Removing the SERVFAIL response on hash collisions.

From: Mark Andrews <[email-masked]>
Date: Wed, 16 Aug 2006 12:46:26 +1000

> 
> 	draft-ietf-dnsext-nsec3-06.txt currently has:
> 
> 6.2.9.  Server Response to a Run-time Collision
> 
>    If the hash of a non-existing QNAME collides with an existing NSEC3
>    ownername, then the server will be unable to return a response that
>    proves that QNAME does not exist.  In this case, the server MUST
>    return a response with an RCODE of 2 (server failure).
> 
>    Note that with the hash algorithm specified in this document, SHA-1,
>    such collisions are astronomically unlikely.
> 
> 	We can disambiguate collisions by returning the original
> 	owner name used to generate the hash.
> 
> 	I propose that NSEC3 wire format be extended to optionally
> 	include a the original owner name at the end of the existing
> 	wire format.  This is *only* returned in AXFR/IXFR and for this
> 	special case.  The RRSIG will be computed over NSEC3 records
> 	as if this extra name was not included.  You can verify the
> 	appended ownername as its hash will be the ownername of the

	s/will be the ownername/will be in the ownername/

> 	NSEC3 record.

	Note we will need to include a length field for the bitmaps
	when we do this.
 
> 	To save space we could exclude the zone name with "."
> 	representing the zone if we do this.
> 
> 	Mark
> -- 
> Mark Andrews, ISC
> 1 Seymour St., Dundas Valley, NSW 2117, Australia
> PHONE:	+61 2 9871 4742		         INTERNET: [email-masked]
> 
> --
> to unsubscribe send a message to [email-masked] with
> the word 'unsubscribe' in a single line as the message text body.
> archive: <http://ops.ietf.org/lists/namedroppers/>
--
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Matt Larson <[email-masked]>
Date: Wed, 16 Aug 2006 15:19:37 -0400

On Wed, 16 Aug 2006, Mark Andrews wrote:
> 	wire format.

I will support this change if you agree to carry around an oxygen tank
for the rest of your life to avoid potential asphyxiation in case all
the air molecules in whatever room you happen to be located in
suddenly move to the other side.

Seriously, with SHA-1 the possibility of this collision is
astronomically low.  More risk would be introduced by increasing code
bloat to deal with this case than the possible damage if the case
itself occurred.

Does SERVFAIL really need to be disambiguated?  I don't think so.  But
if this really bothers anyone, let's burn an extended RCODE to signal
this scenario.  But don't burden the NSEC3 wire format with it.

Matt

---

From: Roy Arends <[email-masked]>
Date: Thu, 17 Aug 2006 14:57:57 +0200

>       representing the zone if we do this.

Note that I'd like to see some kind of consensus on the need to document 
ANY text about 2nd pre-image resistance failover before actually 
documenting the following solution.

iff there is a collision, (enough has been said already about possibility) 
why not return the following:

H(X)=H(Y), X!=Y, X exists, Y does not exist.

rcode=3
QNAME=Y
empty answer section
authority section: 
H(Y) NSEC3 ... ... ...
H(Y) RRSIG NSEC3
X A 10.1.1.1
X RRSIG A ...

Since it is impossible to prove that Y does not exist 'the nsec3 way', we 
prove that X exist, by returning both X and H(X). Since collisions between 
existing names have been avoided during the generation of the NSEC3 
records, we can safely assert that Y does not exist.

This avoids (perceived) SERVFAIL allergy. This avoids fondling with RDATA. 
This is not spoofable, since the deletion of X,RRSIG(X) will leave the 
response broken.

Roy