The Delegation_Only DNSKEY flag
draft-pwouters-powerbind-03
|
Document |
Type |
|
Active Internet-Draft (individual)
|
|
Last updated |
|
2019-11-04
|
|
Stream |
|
(None)
|
|
Intended RFC status |
|
(None)
|
|
Formats |
|
plain text
xml
pdf
htmlized
bibtex
|
Stream |
Stream state |
|
(No stream defined) |
|
Consensus Boilerplate |
|
Unknown
|
|
RFC Editor Note |
|
(None)
|
IESG |
IESG state |
|
I-D Exists
|
|
Telechat date |
|
|
|
Responsible AD |
|
(None)
|
|
Send notices to |
|
(None)
|
DNSOP P. Wouters
Internet-Draft Red Hat
Updates: 4035 (if approved) W. Hardaker
Intended status: Informational USC/ISI
Expires: May 7, 2020 November 4, 2019
The Delegation_Only DNSKEY flag
draft-pwouters-powerbind-03
Abstract
This document introduces a new DNSKEY flag called DELEGATION_ONLY
that indicates that the particular zone will never sign zone data
across a label. That is, every label (dot) underneath is considered
a zone cut and must have its own (signed) delegation. Additionally,
it indicates the zone is expecting its parent to never bypass or
override the zone. DNSSEC Validating Resolvers can use this bit to
mark any data that violates the DELEGATION_ONLY policy as BOGUS.
Status of This Memo
This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet-
Drafts is at http://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
This Internet-Draft will expire on May 7, 2020.
Copyright Notice
Copyright (c) 2019 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must
Wouters & Hardaker Expires May 7, 2020 [Page 1]
Internet-Draft Delegation Only DNSKEYs November 2019
include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License.
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2
2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 3
3. The Deep Link State problem . . . . . . . . . . . . . . . . . 3
4. The DELEGATION_ONLY DNSKEY flag . . . . . . . . . . . . . . . 3
4.1. _underscore label exception . . . . . . . . . . . . . . . 4
4.2. Parental Transparency . . . . . . . . . . . . . . . . . . 4
4.3. Marking zone keys DELEGATION_ONLY without parental
support . . . . . . . . . . . . . . . . . . . . . . . . . 5
4.4. Marking the Root DNSKEY DELEGATION_ONLY . . . . . . . . . 5
4.5. Migrating to and from DELEGATION_ONLY . . . . . . . . . . 5
5. Operational Considerations . . . . . . . . . . . . . . . . . 5
6. Security Considerations . . . . . . . . . . . . . . . . . . . 6
7. Privacy Considerations . . . . . . . . . . . . . . . . . . . 6
8. Human Rights Considerations . . . . . . . . . . . . . . . . . 6
9. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 7
10. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 7
11. References . . . . . . . . . . . . . . . . . . . . . . . . . 7
11.1. Normative References . . . . . . . . . . . . . . . . . . 7
11.2. Informative References . . . . . . . . . . . . . . . . . 8
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 8
1. Introduction
The DNS Security Extensions [DNSSEC] use public key cryptography to
create an hierarchical trust base with the DNSSEC root public keys at
the top, followed by Top Level domain (TLD) keys one level
underneath. While the root and TLD zones are asumed to be almost
exclusively delegation-only zones, there is currently no method to
audit these zones to ensure they behave as a delegation-only zone.
This creates an attractive target for malicious use of these zones -
either by their owners or through coercion.
This document defines a mechanism for zone owners, at DNSKEY creation
time, to indicate they will only delegate the remainder of the tree
to lower-level zones, allowing easier logging and auditing of DNS
responses they serve.
This document introduces a new DNSKEY flag allowing zone owners to
commit that the zone will never sign any DNS data that traverses a
single label and if any such signed data is encountered by validating
Show full document text