<html><head>
<meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type">
</head><body bgcolor="#FFFFFF" text="#000000"><br>
<br>
<blockquote style="border: 0px none;"
cite="mid:C000A68E-A1C3-4F7E-8B0D-15AD3C938E3E@vpnc.org" type="cite">
<div style="margin:30px 25px 10px 25px;" class="__pbConvHr"><div
style="display:table;width:100%;border-top:1px solid
#EDEEF0;padding-top:5px"> <div
style="display:table-cell;vertical-align:middle;padding-right:6px;"><img
photoaddress="paul.hoffman@vpnc.org" photoname="Paul Hoffman"
src="cid:part1.04000107.00020302@redbarn.org"
name="compose-unknown-contact.jpg" height="25px" width="25px"></div> <div
style="display:table-cell;white-space:nowrap;vertical-align:middle;width:100%">
<a moz-do-not-send="true" href="mailto:paul.hoffman@vpnc.org"
style="color:#737F92
!important;padding-right:6px;font-weight:bold;text-decoration:none
!important;">Paul Hoffman</a></div> <div
style="display:table-cell;white-space:nowrap;vertical-align:middle;">
<font color="#9FA2A5"><span style="padding-left:6px">Monday, December
01, 2014 3:48 PM</span></font></div></div></div>
<div style="color: rgb(136, 136, 136); margin-left: 24px;
margin-right: 24px;" __pbrmquotes="true" class="__pbConvBody"><div>People
have asked for two things:<br><br>1) Getting the root zone by means
other than AXFR, such as by HTTP<br><br>2) Being sure that they got the
exact root zone, including all of the glue records<br></div></div>
</blockquote>
<br>
i think you meant "zone" not "root zone" here.<br>
<blockquote style="border: 0px none;"
cite="mid:C000A68E-A1C3-4F7E-8B0D-15AD3C938E3E@vpnc.org" type="cite">
<div style="color: rgb(136, 136, 136); margin-left: 24px;
margin-right: 24px;" __pbrmquotes="true" class="__pbConvBody">
<div><br>A signed hash meets (2) regardless of how the zone was
transmitted.<br></div>
</div>
</blockquote>
<br>
not inevitably. the verification tool would be new logic, either built
into the secondary name server, or as an outboard tool available to the
transfer mechanism. when i compare the complexity-cost of that tool to
the contents of the <a class="moz-txt-link-rfc2396E" href="ftp://ftp.internic.net/domain"><ftp://ftp.internic.net/domain></a> directory, i
see that existing tools whose complexity-cost i already pay would work
just fine. (those being pgp and md5sum). so, a detached signature can in
some cases meet (2) far more easily than an in-band signature.<br>
<br>
it's also the case that rsync and similar tools (and AXFR) use TCP which
most of us consider "reliable" even though its checksums aren't nearly
as strong as SCTP's. therefore your problem statement "being sure they
got the exact right zone" would have to refer to an MiTM, possibly
inside the secondary server (if the zone receiver is a tertiary), or
possibly on-path. in either case, to frustrate the MiTM, the proposed
in-band signature would have to be DNSSEC based.<br>
<br>
and there is already an in-band DNSSEC-based zone identity/coherency
test -- zone walking. why would we add another way to do the same thing
we could do with existing DNSSEC data?<br>
<blockquote style="border: 0px none;"
cite="mid:C000A68E-A1C3-4F7E-8B0D-15AD3C938E3E@vpnc.org" type="cite">
<div style="color:#888888;margin-left:24px;margin-right:24px;"
__pbrmquotes="true" class="__pbConvBody">
<div><br>...<br>Adding a record that says "here is a hash of this
zone", and adding an RRSIG for that record, is the simplest solution.
There are other solutions that are exactly as secure; however, they are
all more complex, and some involve using the zone signing key for
signing something other than the contents of an RRSIG.</div>
</div>
</blockquote>
i think walking the existing zone and verifying that there are no
records between the nsecs and that every signature is valid and that the
nsec chain ends at the apex, is simpler.<br>
<br>
vixie<br>
</body></html>