5 Network Working Group M. StJohns
6 Internet-Draft Nominum, Inc.
7 Expires: February 16, 2006 August 15, 2005
10 Automated Updates of DNSSEC Trust Anchors
11 draft-ietf-dnsext-trustupdate-timers-01
15 By submitting this Internet-Draft, each author represents that any
16 applicable patent or other IPR claims of which he or she is aware
17 have been or will be disclosed, and any of which he or she becomes
18 aware will be disclosed, in accordance with Section 6 of BCP 79.
20 Internet-Drafts are working documents of the Internet Engineering
21 Task Force (IETF), its areas, and its working groups. Note that
22 other groups may also distribute working documents as Internet-
25 Internet-Drafts are draft documents valid for a maximum of six months
26 and may be updated, replaced, or obsoleted by other documents at any
27 time. It is inappropriate to use Internet-Drafts as reference
28 material or to cite them other than as "work in progress."
30 The list of current Internet-Drafts can be accessed at
31 http://www.ietf.org/ietf/1id-abstracts.txt.
33 The list of Internet-Draft Shadow Directories can be accessed at
34 http://www.ietf.org/shadow.html.
36 This Internet-Draft will expire on February 16, 2006.
40 Copyright (C) The Internet Society (2005).
44 This document describes a means for automated, authenticated and
45 authorized updating of DNSSEC "trust anchors". The method provides
46 protection against single key compromise of a key in the trust point
47 key set. Based on the trust established by the presence of a current
48 anchor, other anchors may be added at the same place in the
49 hierarchy, and, ultimately, supplant the existing anchor.
51 This mechanism, if adopted, will require changes to resolver
52 management behavior (but not resolver resolution behavior), and the
56 StJohns Expires February 16, 2006 [Page 1]
58 Internet-Draft trustanchor-update August 2005
61 addition of a single flag bit to the DNSKEY record.
65 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3
66 1.1 Compliance Nomenclature . . . . . . . . . . . . . . . . . 3
67 1.2 Changes since -00 . . . . . . . . . . . . . . . . . . . . 3
68 2. Theory of Operation . . . . . . . . . . . . . . . . . . . . . 4
69 2.1 Revocation . . . . . . . . . . . . . . . . . . . . . . . . 4
70 2.2 Add Hold-Down . . . . . . . . . . . . . . . . . . . . . . 4
71 2.3 Remove Hold-down . . . . . . . . . . . . . . . . . . . . . 5
72 2.4 Active Refresh . . . . . . . . . . . . . . . . . . . . . . 6
73 2.5 Resolver Parameters . . . . . . . . . . . . . . . . . . . 6
74 2.5.1 Add Hold-Down Time . . . . . . . . . . . . . . . . . . 6
75 2.5.2 Remove Hold-Down Time . . . . . . . . . . . . . . . . 6
76 2.5.3 Minimum Trust Anchors per Trust Point . . . . . . . . 6
77 3. Changes to DNSKEY RDATA Wire Format . . . . . . . . . . . . . 6
78 4. State Table . . . . . . . . . . . . . . . . . . . . . . . . . 6
79 4.1 Events . . . . . . . . . . . . . . . . . . . . . . . . . . 7
80 4.2 States . . . . . . . . . . . . . . . . . . . . . . . . . . 7
81 5. Scenarios . . . . . . . . . . . . . . . . . . . . . . . . . . 8
82 5.1 Adding A Trust Anchor . . . . . . . . . . . . . . . . . . 8
83 5.2 Deleting a Trust Anchor . . . . . . . . . . . . . . . . . 9
84 5.3 Key Roll-Over . . . . . . . . . . . . . . . . . . . . . . 9
85 5.4 Active Key Compromised . . . . . . . . . . . . . . . . . . 9
86 5.5 Stand-by Key Compromised . . . . . . . . . . . . . . . . . 9
87 6. Security Considerations . . . . . . . . . . . . . . . . . . . 10
88 6.1 Key Ownership vs Acceptance Policy . . . . . . . . . . . . 10
89 6.2 Multiple Key Compromise . . . . . . . . . . . . . . . . . 10
90 6.3 Dynamic Updates . . . . . . . . . . . . . . . . . . . . . 10
91 7. Normative References . . . . . . . . . . . . . . . . . . . . . 10
92 Editorial Comments . . . . . . . . . . . . . . . . . . . . . . 11
93 Author's Address . . . . . . . . . . . . . . . . . . . . . . . 11
94 Intellectual Property and Copyright Statements . . . . . . . . 12
112 StJohns Expires February 16, 2006 [Page 2]
114 Internet-Draft trustanchor-update August 2005
119 As part of the reality of fielding DNSSEC (Domain Name System
120 Security Extensions) [RFC2535] [RFC4033][RFC4034][RFC4035], the
121 community has come to the realization that there will not be one
122 signed name space, but rather islands of signed name space each
123 originating from specific points (i.e. 'trust points') in the DNS
124 tree. Each of those islands will be identified by the trust point
125 name, and validated by at least one associated public key. For the
126 purpose of this document we'll call the association of that name and
127 a particular key a 'trust anchor'. A particular trust point can have
128 more than one key designated as a trust anchor.
130 For a DNSSEC-aware resolver to validate information in a DNSSEC
131 protected branch of the hierarchy, it must have knowledge of a trust
132 anchor applicable to that branch. It may also have more than one
133 trust anchor for any given trust point. Under current rules, a chain
134 of trust for DNSSEC-protected data that chains its way back to ANY
135 known trust anchor is considered 'secure'.
137 Because of the probable balkanization of the DNSSEC tree due to
138 signing voids at key locations, a resolver may need to know literally
139 thousands of trust anchors to perform its duties. (e.g. Consider an
140 unsigned ".COM".) Requiring the owner of the resolver to manually
141 manage this many relationships is problematic. It's even more
142 problematic when considering the eventual requirement for key
143 replacement/update for a given trust anchor. The mechanism described
144 herein won't help with the initial configuration of the trust anchors
145 in the resolvers, but should make trust point key replacement/
146 rollover more viable.
148 As mentioned above, this document describes a mechanism whereby a
149 resolver can update the trust anchors for a given trust point, mainly
150 without human intervention at the resolver. There are some corner
151 cases discussed (e.g. multiple key compromise) that may require
152 manual intervention, but they should be few and far between. This
153 document DOES NOT discuss the general problem of the initial
154 configuration of trust anchors for the resolver.
156 1.1 Compliance Nomenclature
158 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
159 "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
160 document are to be interpreted as described in BCP 14, [RFC2119].
162 1.2 Changes since -00
164 Added the concept of timer triggered resolver queries to refresh the
168 StJohns Expires February 16, 2006 [Page 3]
170 Internet-Draft trustanchor-update August 2005
173 resolvers view of the trust anchor key RRSet.
175 Re-submitted expired draft as -01. Updated DNSSEC RFC References.
177 2. Theory of Operation
179 The general concept of this mechanism is that existing trust anchors
180 can be used to authenticate new trust anchors at the same point in
181 the DNS hierarchy. When a new SEP key is added to a trust point
182 DNSKEY RRSet, and when that RRSet is validated by an existing trust
183 anchor, then the new key can be added to the set of trust anchors.
185 There are some issues with this approach which need to be mitigated.
186 For example, a compromise of one of the existing keys could allow an
187 attacker to add their own 'valid' data. This implies a need for a
188 method to revoke an existing key regardless of whether or not that
189 key is compromised. As another example assuming a single key
190 compromise, an attacker could add a new key and revoke all the other
195 Assume two trust anchor keys A and B. Assume that B has been
196 compromised. Without a specific revocation bit, B could invalidate A
197 simply by sending out a signed trust point key set which didn't
198 contain A. To fix this, we add a mechanism which requires knowledge
199 of the private key of a DNSKEY to revoke that DNSKEY.
201 A key is considered revoked when the resolver sees the key in a self-
202 signed RRSet and the key has the REVOKE bit set to '1'. Once the
203 resolver sees the REVOKE bit, it MUST NOT use this key as a trust
204 anchor or for any other purposes except validating the RRSIG over the
205 DNSKEY RRSet specifically for the purpose of validating the
206 revocation. Unlike the 'Add' operation below, revocation is
207 immediate and permanent upon receipt of a valid revocation at the
210 N.B. A DNSKEY with the REVOKE bit set has a different fingerprint
211 than one without the bit set. This affects the matching of a DNSKEY
212 to DS records in the parent, or the fingerprint stored at a resolver
213 used to configure a trust point. [msj3]
215 In the given example, the attacker could revoke B because it has
216 knowledge of B's private key, but could not revoke A.
220 Assume two trust point keys A and B. Assume that B has been
224 StJohns Expires February 16, 2006 [Page 4]
226 Internet-Draft trustanchor-update August 2005
229 compromised. An attacker could generate and add a new trust anchor
230 key - C (by adding C to the DNSKEY RRSet and signing it with B), and
231 then invalidate the compromised key. This would result in the both
232 the attacker and owner being able to sign data in the zone and have
233 it accepted as valid by resolvers.
235 To mitigate, but not completely solve, this problem, we add a hold-
236 down time to the addition of the trust anchor. When the resolver
237 sees a new SEP key in a validated trust point DNSKEY RRSet, the
238 resolver starts an acceptance timer, and remembers all the keys that
239 validated the RRSet. If the resolver ever sees the DNSKEY RRSet
240 without the new key but validly signed, it stops the acceptance
241 process and resets the acceptance timer. If all of the keys which
242 were originally used to validate this key are revoked prior to the
243 timer expiring, the resolver stops the acceptance process and resets
246 Once the timer expires, the new key will be added as a trust anchor
247 the next time the validated RRSet with the new key is seen at the
248 resolver. The resolver MUST NOT treat the new key as a trust anchor
249 until the hold down time expires AND it has retrieved and validated a
250 DNSKEY RRSet after the hold down time which contains the new key.
252 N.B.: Once the resolver has accepted a key as a trust anchor, the key
253 MUST be considered a valid trust anchor by that resolver until
254 explictly revoked as described above.
256 In the given example, the zone owner can recover from a compromise by
257 revoking B and adding a new key D and signing the DNSKEY RRSet with
260 The reason this does not completely solve the problem has to do with
261 the distributed nature of DNS. The resolver only knows what it sees.
262 A determined attacker who holds one compromised key could keep a
263 single resolver from realizing that key had been compromised by
264 intercepting 'real' data from the originating zone and substituting
265 their own (e.g. using the example, signed only by B). This is no
266 worse than the current situation assuming a compromised key.
270 A new key which has been seen by the resolver, but hasn't reached
271 it's add hold-down time, MAY be removed from the DNSKEY RRSet by the
272 zone owner. If the resolver sees a validated DNSKEY RRSet without
273 this key, it waits for the remove hold-down time and then, if the key
274 hasn't reappeared, SHOULD discard any information about the key.
280 StJohns Expires February 16, 2006 [Page 5]
282 Internet-Draft trustanchor-update August 2005
287 A resolver which has been configured for automatic update of keys
288 from a particular trust point MUST query that trust point (e.g. do a
289 lookup for the DNSKEY RRSet and related RRSIG records) no less often
290 than the lesser of 15 days or half the original TTL for the DNSKEY
291 RRSet or half the RRSIG expiration interval. The expiration interval
292 is the amount of time from when the RRSIG was last retrieved until
293 the expiration time in the RRSIG.
295 If the query fails, the resolver MUST repeat the query until
296 satisfied no more often than once an hour and no less often than the
297 lesser of 1 day or 10% of the original TTL or 10% of the original
300 2.5 Resolver Parameters
302 2.5.1 Add Hold-Down Time
304 The add hold-down time is 30 days or the expiration time of the TTL
305 of the first trust point DNSKEY RRSet which contained the key,
306 whichever is greater. This ensures that at least two validated
307 DNSKEY RRSets which contain the new key MUST be seen by the resolver
308 prior to the key's acceptance.
310 2.5.2 Remove Hold-Down Time
312 The remove hold-down time is 30 days.
314 2.5.3 Minimum Trust Anchors per Trust Point
316 A compliant resolver MUST be able to manage at least five SEP keys
319 3. Changes to DNSKEY RDATA Wire Format
321 Bit n [msj2] of the DNSKEY Flags field is designated as the 'REVOKE'
322 flag. If this bit is set to '1', AND the resolver sees an
323 RRSIG(DNSKEY) signed by the associated key, then the resolver MUST
324 consider this key permanently invalid for all purposes except for
325 validing the revocation.
329 The most important thing to understand is the resolver's view of any
330 key at a trust point. The following state table describes that view
331 at various points in the key's lifetime. The table is a normative
332 part of this specification. The initial state of the key is 'Start'.
336 StJohns Expires February 16, 2006 [Page 6]
338 Internet-Draft trustanchor-update August 2005
341 The resolver's view of the state of the key changes as various events
344 [msj1] This is the state of a trust point key as seen from the
345 resolver. The column on the left indicates the current state. The
346 header at the top shows the next state. The intersection of the two
347 shows the event that will cause the state to transition from the
348 current state to the next.
351 --------------------------------------------------
352 FROM |Start |AddPend |Valid |Missing|Revoked|Removed|
353 ----------------------------------------------------------
354 Start | |NewKey | | | | |
355 ----------------------------------------------------------
356 AddPend |KeyRem | |AddTime| | |
357 ----------------------------------------------------------
358 Valid | | | |KeyRem |Revbit | |
359 ----------------------------------------------------------
360 Missing | | |KeyPres| |Revbit | |
361 ----------------------------------------------------------
362 Revoked | | | | | |RemTime|
363 ----------------------------------------------------------
364 Removed | | | | | | |
365 ----------------------------------------------------------
369 NewKey The resolver sees a valid DNSKEY RRSet with a new SEP key.
370 That key will become a new trust anchor for the named trust point
371 after its been present in the RRSet for at least 'add time'.
372 KeyPres The key has returned to the valid DNSKEY RRSet.
373 KeyRem The resolver sees a valid DNSKEY RRSet that does not contain
375 AddTime The key has been in every valid DNSKEY RRSet seen for at
376 least the 'add time'.
377 RemTime A revoked key has been missing from the trust point DNSKEY
378 RRSet for sufficient time to be removed from the trust set.
379 RevBit The key has appeared in the trust anchor DNSKEY RRSet with its
380 "REVOKED" bit set, and there is an RRSig over the DNSKEY RRSet
384 Start The key doesn't yet exist as a trust anchor at the resolver.
385 It may or may not exist at the zone server, but hasn't yet been
386 seen at the resolver.
392 StJohns Expires February 16, 2006 [Page 7]
394 Internet-Draft trustanchor-update August 2005
397 AddPend The key has been seen at the resolver, has its 'SEP' bit set,
398 and has been included in a validated DNSKEY RRSet. There is a
399 hold-down time for the key before it can be used as a trust
401 Valid The key has been seen at the resolver and has been included in
402 all validated DNSKEY RRSets from the time it was first seen up
403 through the hold-down time. It is now valid for verifying RRSets
404 that arrive after the hold down time. Clarification: The DNSKEY
405 RRSet does not need to be continuously present at the resolver
406 (e.g. its TTL might expire). If the RRSet is seen, and is
407 validated (i.e. verifies against an existing trust anchor), this
408 key MUST be in the RRSet otherwise a 'KeyRem' event is triggered.
409 Missing This is an abnormal state. The key remains as a valid trust
410 point key, but was not seen at the resolver in the last validated
411 DNSKEY RRSet. This is an abnormal state because the zone operator
412 should be using the REVOKE bit prior to removal. [Discussion
413 item: Should a missing key be considered revoked after some
415 Revoked This is the state a key moves to once the resolver sees an
416 RRSIG(DNSKEY) signed by this key where that DNSKEY RRSet contains
417 this key with its REVOKE bit set to '1'. Once in this state, this
418 key MUST permanently be considered invalid as a trust anchor.
419 Removed After a fairly long hold-down time, information about this
420 key may be purged from the resolver. A key in the removed state
421 MUST NOT be considered a valid trust anchor.
425 The suggested model for operation is to have one active key and one
426 stand-by key at each trust point. The active key will be used to
427 sign the DNSKEY RRSet. The stand-by key will not normally sign this
428 RRSet, but the resolver will accept it as a trust anchor if/when it
429 sees the signature on the trust point DNSKEY RRSet.
431 Since the stand-by key is not in active signing use, the associated
432 private key may (and SHOULD) be provided with additional protections
433 not normally available to a key that must be used frequently. E.g.
434 locked in a safe, split among many parties, etc. Notionally, the
435 stand-by key should be less subject to compromise than an active key,
436 but that will be dependent on operational concerns not addressed
439 5.1 Adding A Trust Anchor
441 Assume an existing trust anchor key 'A'.
442 1. Generate a new key pair.
448 StJohns Expires February 16, 2006 [Page 8]
450 Internet-Draft trustanchor-update August 2005
453 2. Create a DNSKEY record from the key pair and set the SEP and Zone
455 3. Add the DNSKEY to the RRSet.
456 4. Sign the DNSKEY RRSet ONLY with the existing trust anchor key -
460 5.2 Deleting a Trust Anchor
462 Assume existing trust anchors 'A' and 'B' and that you want to revoke
464 1. Set the revolcation bit on key 'A'.
465 2. Sign the DNSKEY RRSet with both 'A' and 'B'.
466 'A' is now revoked. The operator SHOULD include the revoked 'A' in
467 the RRSet for at least the remove hold-down time, but then may remove
468 it from the DNSKEY RRSet.
472 Assume existing keys A and B. 'A' is actively in use (i.e. has been
473 signing the DNSKEY RRSet.) 'B' was the stand-by key. (i.e. has been
474 in the DNSKEY RRSet and is a valid trust anchor, but wasn't being
475 used to sign the RRSet.)
476 1. Generate a new key pair 'C'.
477 2. Add 'C' to the DNSKEY RRSet.
478 3. Set the revocation bit on key 'A'.
479 4. Sign the RRSet with 'A' and 'B'.
480 'A' is now revoked, 'B' is now the active key, and 'C' will be the
481 stand-by key once the hold-down expires. The operator SHOULD include
482 the revoked 'A' in the RRSet for at least the remove hold-down time,
483 but may then remove it from the DNSKEY RRSet.
485 5.4 Active Key Compromised
487 This is the same as the mechanism for Key Roll-Over (Section 5.3)
488 above assuming 'A' is the active key.
490 5.5 Stand-by Key Compromised
492 Using the same assumptions and naming conventions as Key Roll-Over
494 1. Generate a new key pair 'C'.
495 2. Add 'C' to the DNSKEY RRSet.
496 3. Set the revocation bit on key 'B'.
497 4. Sign the RRSet with 'A' and 'B'.
498 'B' is now revoked, 'A' remains the active key, and 'C' will be the
499 stand-by key once the hold-down expires. 'B' SHOULD continue to be
500 included in the RRSet for the remove hold-down time.
504 StJohns Expires February 16, 2006 [Page 9]
506 Internet-Draft trustanchor-update August 2005
509 6. Security Considerations
511 6.1 Key Ownership vs Acceptance Policy
513 The reader should note that, while the zone owner is responsible
514 creating and distributing keys, it's wholly the decision of the
515 resolver owner as to whether to accept such keys for the
516 authentication of the zone information. This implies the decision
517 update trust anchor keys based on trust for a current trust anchor
518 key is also the resolver owner's decision.
520 The resolver owner (and resolver implementers) MAY choose to permit
521 or prevent key status updates based on this mechanism for specific
522 trust points. If they choose to prevent the automated updates, they
523 will need to establish a mechanism for manual or other out-of-band
524 updates outside the scope of this document.
526 6.2 Multiple Key Compromise
528 This scheme permits recovery as long as at least one valid trust
529 anchor key remains uncompromised. E.g. if there are three keys, you
530 can recover if two of them are compromised. The zone owner should
531 determine their own level of comfort with respect to the number of
532 active valid trust anchors in a zone and should be prepared to
533 implement recovery procedures once they detect a compromise. A
534 manual or other out-of-band update of all resolvers will be required
535 if all trust anchor keys at a trust point are compromised.
539 Allowing a resolver to update its trust anchor set based in-band key
540 information is potentially less secure than a manual process.
541 However, given the nature of the DNS, the number of resolvers that
542 would require update if a trust anchor key were compromised, and the
543 lack of a standard management framework for DNS, this approach is no
544 worse than the existing situation.
546 7. Normative References
548 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
549 Requirement Levels", BCP 14, RFC 2119, March 1997.
551 [RFC2535] Eastlake, D., "Domain Name System Security Extensions",
552 RFC 2535, March 1999.
554 [RFC4033] Arends, R., Austein, R., Larson, M., Massey, D., and S.
555 Rose, "DNS Security Introduction and Requirements",
556 RFC 4033, March 2005.
560 StJohns Expires February 16, 2006 [Page 10]
562 Internet-Draft trustanchor-update August 2005
565 [RFC4034] Arends, R., Austein, R., Larson, M., Massey, D., and S.
566 Rose, "Resource Records for the DNS Security Extensions",
567 RFC 4034, March 2005.
569 [RFC4035] Arends, R., Austein, R., Larson, M., Massey, D., and S.
570 Rose, "Protocol Modifications for the DNS Security
571 Extensions", RFC 4035, March 2005.
575 [msj1] msj: N.B. This table is preliminary and will be revised to
576 match implementation experience. For example, should there
577 be a state for "Add hold-down expired, but haven't seen the
580 [msj2] msj: To be assigned.
582 [msj3] msj: For discussion: What's the implementation guidance for
583 resolvers currently with respect to the non-assigned flag
584 bits? If they consider the flag bit when doing key matching
585 at the trust anchor, they won't be able to match.
593 Redwood City, CA 94063
596 Phone: +1-301-528-4729
597 Email: Mike.StJohns@nominum.com
616 StJohns Expires February 16, 2006 [Page 11]
618 Internet-Draft trustanchor-update August 2005
621 Intellectual Property Statement
623 The IETF takes no position regarding the validity or scope of any
624 Intellectual Property Rights or other rights that might be claimed to
625 pertain to the implementation or use of the technology described in
626 this document or the extent to which any license under such rights
627 might or might not be available; nor does it represent that it has
628 made any independent effort to identify any such rights. Information
629 on the procedures with respect to rights in RFC documents can be
630 found in BCP 78 and BCP 79.
632 Copies of IPR disclosures made to the IETF Secretariat and any
633 assurances of licenses to be made available, or the result of an
634 attempt made to obtain a general license or permission for the use of
635 such proprietary rights by implementers or users of this
636 specification can be obtained from the IETF on-line IPR repository at
637 http://www.ietf.org/ipr.
639 The IETF invites any interested party to bring to its attention any
640 copyrights, patents or patent applications, or other proprietary
641 rights that may cover technology that may be required to implement
642 this standard. Please address the information to the IETF at
645 The IETF has been notified of intellectual property rights claimed in
646 regard to some or all of the specification contained in this
647 document. For more information consult the online list of claimed
651 Disclaimer of Validity
653 This document and the information contained herein are provided on an
654 "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
655 OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET
656 ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED,
657 INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE
658 INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
659 WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
664 Copyright (C) The Internet Society (2005). This document is subject
665 to the rights, licenses and restrictions contained in BCP 78, and
666 except as set forth therein, the authors retain all their rights.
672 StJohns Expires February 16, 2006 [Page 12]
674 Internet-Draft trustanchor-update August 2005
679 Funding for the RFC Editor function is currently provided by the
728 StJohns Expires February 16, 2006 [Page 13]