Re: MAR proposal #1: Algorithm downgrade protection
Edward Lewis <Ed.Lewis <at> neustar.biz>
2011-04-01 14:53:09 GMT
At 10:24 -0400 4/1/11, Samuel Weiler wrote:
>This is a proposed change in DNSSECbis that arguably changes the
>mandatory algorithm rules. I'm posting this as a summary of what I
>understand some may support, I don't support this change myself.
>Please post in this thread with your support or lack thereof.
>In order to provide some protection against algorithm downgrade,
>we're defining a mechanism for zone signers to signal to validators
>that a SET of algorithms should ALL be checked, when possible,
>before determining that an answer from the zone is Secure.
>Specifically, we're overloading the DS RRset to do that signalling.
>Validators SHOULD check signatures from all algorithms present in a
>zone's DS RRset or trust anchors before declaring an answer from the
>zone to be Secure. If it is impossible to validate an answer with
>one or more of those algorithms, the answer SHOULD be treated as
>This is a subset of the checks unbound was performing that let to
>the discovery of the problems with .cz's algorithm roll process.
>Please post in this thread with your support or objections.
IMHO, algorithm downgrade protection is not a goal of DNSSEC.
Further, there is no way an algorithm downgrade attack can succeed.
Presuming validation, when a resolver receives an answer section
containing an RRset matching it's query, a resolver has to determine
if the data is known to be insecure or is supposed to be secured.