<div dir="ltr"><br><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Dec 1, 2014 at 6:13 PM, Paul Vixie <span dir="ltr"><<a href="mailto:paul@redbarn.org" target="_blank">paul@redbarn.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div bgcolor="#FFFFFF" text="#000000"><br>
<blockquote style="border:0px none" type="cite">
<div style="margin:30px 25px 10px"><div style="display:table;width:100%;border-top-width:1px;border-top-style:solid;border-top-color:rgb(237,238,240);padding-top:5px"> <div style="display:table-cell;vertical-align:middle;padding-right:6px"><img src="cid:part1.08070203.07000309@redbarn.org" name="14a08479348b88bf_postbox-contact.jpg" height="25px" width="25px"></div> <div style="display:table-cell;white-space:nowrap;vertical-align:middle;width:100%">
<a href="mailto:paul@redbarn.org" style="padding-right:6px;font-weight:bold;color:rgb(115,127,146)!important;text-decoration:none!important" target="_blank">Paul Vixie</a></div> <div style="display:table-cell;white-space:nowrap;vertical-align:middle">
<font color="#9FA2A5"><span style="padding-left:6px">Sunday, November
30, 2014 2:29 PM</span></font></div></div></div>
<div style="color:rgb(136,136,136);margin-left:24px;margin-right:24px">
<br>
why? (your use case is not obvious from what you've written.) ...<br>
</div>
</blockquote>
<blockquote style="border:0px none" type="cite">
<div style="margin:30px 25px 10px"><div style="display:table;width:100%;border-top-width:1px;border-top-style:solid;border-top-color:rgb(237,238,240);padding-top:5px"> <div style="display:table-cell;vertical-align:middle;padding-right:6px"><img src="cid:part2.07090107.00090702@redbarn.org" name="14a08479348b88bf_compose-unknown-contact.jpg" height="25px" width="25px"></div> <div style="display:table-cell;white-space:nowrap;vertical-align:middle;width:100%">
<a href="mailto:cra@wpi.edu" style="padding-right:6px;font-weight:bold;color:rgb(115,127,146)!important;text-decoration:none!important" target="_blank">Chuck Anderson</a></div> <div style="display:table-cell;white-space:nowrap;vertical-align:middle">
<font color="#9FA2A5"><span style="padding-left:6px">Monday, December
01, 2014 7:09 AM</span></font></div></div></div><span class="">
<div style="color:rgb(136,136,136);margin-left:24px;margin-right:24px"><div><br>Silent on-disk
corruption. It happens, and it would be nice to be<br>able to detect
that.<br></div></div>
<br>
</span></blockquote>
if you're concerned about operating system or hardware or network
errors, then i assume you're also concerned about them hitting your name
server executable, in which case you'll be running a file system like
ZFS that catches these things.<br>
<br>
if you're concerned about malevolent on-disk editing, then i assume
you're running something like tripwire to snapshot with secure hashes
every file in your operating system, and that it will have hooks to
manage and monitor the zone files as well.<br>
<br>
either way i'm not seeing a unique "has to be done with an in-zone
signature" situation here.</div></blockquote><div><br></div><div>It's not necessarily a "has to be done with an in-zone signature", but doing it with an in-zone signature is:</div><div>A: easy</div><div>B: convenient</div><div>C: I have a single blob I can validate.</div><div>If you are concerned about malevolent on-disk editing and OS issues, you can run ZFS and tripwire to snapshot with secure hashes every file *as well as this".<br></div><div><br></div><div>Using the root-zone as an example, currently if I want to validate the zone I do:</div><div><div>wkumari-macbookpro1:root-zone wkumari$ wget -q <a href="ftp://ftp.internic.net/domain/root.zone">ftp://ftp.internic.net/domain/root.zone</a></div><div>wkumari-macbookpro1:root-zone wkumari$ wget -q <a href="ftp://ftp.internic.net/domain/root.zone.sig">ftp://ftp.internic.net/domain/root.zone.sig</a></div><div>wkumari-macbookpro1:root-zone wkumari$ gpg --verify root.zone.sig root.zone</div><div>gpg: Signature made Mon Dec 1 13:53:30 2014 EST using DSA key ID 4150E298</div><div>gpg: Good signature from "Registry Administrator <<a href="mailto:nstld@verisign-grs.com">nstld@verisign-grs.com</a>>"</div></div><div>(entertainingly enough I trust 4150E298 because it was signed on 2013-02-11 by "Larson, Matt </o=VERISIGN/ou=VA-EAST/cn=Recipients/cn=mlarson>")</div><div><br></div><div>Clearly detached signatures *do* work, but if I happened to get the root.zone at 6:52:59PM and the root.zone.sig file at 6:53:01PM I'd have an issue (noting that the file time stamp is "6:53:00 PM") I now have an issue. This also gets finicky if I try and keep multiple copies of the zones for historical reasons, to be able to show that what I served was what I got, etc. Yes, having version numbers on the files and detached sigs is doable (or simply retrying if I get a validation failure, etc) but I cannot see the downside to including it in the zone as well - if you dislike the ZONESIG RR (just made up name) you can simply choose not to check it. </div><div><br></div><div>Similarly, if someone emails me example.com.db and says "Please serve this zonefile, I signed it with my GPG key, and the signature is 0xdeadbeef...cafe" (or "I attached example.com.db.sig") I have a bunch more places where things could go wrong, including the obvious forgetting to attach both files, having a signature for serial <span style="color:rgb(0,0,0);white-space:pre-wrap">2014120117 and the zone contents for serial </span><span style="color:rgb(0,0,0);white-space:pre-wrap">2014120142, etc.</span><span style="color:rgb(0,0,0);white-space:pre-wrap"> </span></div><div>Having "Here is the signed zone example.com.db" and passing that to "load_and_validate_zone.sh" or 'rndc addzone --validate <a href="http://example.com">example.com</a>." is (IMO) much less error prone.</div><div><br></div><div><div><font color="#000000"><span style="white-space:pre-wrap">I think that this is similar to how, when you get a PGP signed email you get the signature in the same message, and not one email saying "Foo Bar Baz" and then a second email with a signature for the first message.</span></font></div></div><div><font color="#000000"><span style="white-space:pre-wrap"><br></span></font></div><div><font color="#000000"><span style="white-space:pre-wrap"><br></span></font></div><div><font color="#000000"><span style="white-space:pre-wrap">W</span></font></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div bgcolor="#FFFFFF" text="#000000"><span class=""><font color="#888888"><br>
<br>
<div>-- <br>Paul Vixie<br>
</div>
</font></span></div>
<br>_______________________________________________<br>
dns-operations mailing list<br>
<a href="mailto:dns-operations@lists.dns-oarc.net">dns-operations@lists.dns-oarc.net</a><br>
<a href="https://lists.dns-oarc.net/mailman/listinfo/dns-operations
dns-jobs" target="_blank">https://lists.dns-oarc.net/mailman/listinfo/dns-operations<br>
dns-jobs</a> mailing list<br>
<a href="https://lists.dns-oarc.net/mailman/listinfo/dns-jobs" target="_blank">https://lists.dns-oarc.net/mailman/listinfo/dns-jobs</a><br></blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature">I don't think the execution is relevant when it was obviously a bad idea in the first place.<br>This is like putting rabid weasels in your pants, and later expressing regret at having chosen those particular rabid weasels and that pair of pants.<br> ---maf</div>
</div></div>