Re: [dnsext] Trust Anchors

["W.C.A. Wijngaards" <wouter@NLnetLabs.nl>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi Bob,

+1 for CLOSEST.  (But I already voiced that before).

Bob Halley wrote:
>> Supporters of CLOSEST argue that the detection of a compromise or other
>> problem in the parent is good security.
Paul Vixie wrote:
> enclosing static trust anchors are a bad idea, and if they are configured
> then the software should syslog a warning about it, early and often.

There is even a worse problem than Paul mentions, use two layers
of trust anchor, ANY, and the following happens:

example.com: signed by local company, trust anchor.
com: signed but example.com is not signed, trust anchor.
(fairly regular case where the company uses a domain internally,
and .com is using, say, opt-out NSEC3)

In this case, the people from verisign and local IT are good,
and the anchors may be up to date, but some (spoofed) response
makes the validator to up from the valid example.com dnskey to
the securely-insecure-delegation from .com.

It can be fixed, 'MOSTLY-ANY', where the chain of trust MUST
extend securely to the lowest trust-anchor available.  Thus,
an invalid trust anchor is then not a no-op but instead it
states 'must be secure at this domain'.  If ANY is adopted
I suggest this so as to make it secure.

I think it is getting complicated for little benefit, hence CLOSEST.

Best regards,
   Wouter

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAkrlpxMACgkQkDLqNwOhpPho3gCgqfCUyKCF2z/DIZaSoIX35zcY
fzoAniLYU/LaiI4DB3TYWCy500yO6Ojc
=ZK8K
-----END PGP SIGNATURE-----