section. This is a change in the existing standard [RFCs 1034,
1035] which contemplates only NS and SOA RRs in the authority
section.
5. Optionally, DNS transactions may be authenticated by a SIG RR at
the end of the response in the additional information section
(Section 4.1.8.1). Such SIG RRs are signed by the DNS server
originating the response. Although the signer field MUST be a
name of the originating server host, the owner name, class, TTL,
and original TTL, are meaningless. The class and TTL fields
SHOULD be zero. To conserve space, the owner name SHOULD be
root (a single zero octet). If transaction authentication is
desired, that SIG RR must be considered the highest priority for
inclusion.
4.3 Processing Responses and SIG RRs
The following rules apply to the processing of SIG RRs included in a
response:
1. A security aware resolver that receives a response from a
security aware server via a secure communication with the AD bit
(see Section 6.1) set, MAY choose to accept the RRs as received
without verifying the zone SIG RRs.
2. In other cases, a security aware resolver SHOULD verify the SIG
RRs for the RRs of interest. This may involve initiating
additional queries for SIG or KEY RRs, especially in the case of
getting a response from a server that does not implement
security. (As explained in 2.3.5 above, it will not be possible
to secure CNAMEs being served up by non-secure resolvers.)
NOTE: Implementers might expect the above SHOULD to be a MUST.
However, local policy or the calling application may not require
the security services.
3. If SIG RRs are received in response to a user query explicitly
specifying the SIG type, no special processing is required.
If the message does not pass integrity checks or the SIG does not
check against the signed RRs, the SIG RR is invalid and should be
ignored. If all of the SIG RR(s) purporting to authenticate an RRset
are invalid, then the RRset is not authenticated.
If the SIG RR is the last RR in a response in the additional
information section and has a type covered of zero, it is a
transaction signature of the response and the query that produced the
response. It MAY be optionally checked and the message rejected if
the checks fail. But even if the checks succeed, such a transaction
authentication SIG does NOT directly authenticate any RRs in the
message. Only a proper SIG RR signed by the zone or a key tracing
its authority to the zone or to static resolver configuration can
directly authenticate RRs, depending on resolver policy (see Section
6). If a resolver does not implement transaction and/or request
SIGs, it MUST ignore them without error.
If all checks indicate that the SIG RR is valid then RRs verified by
it should be considered authenticated.
4.4 Signature Lifetime, Expiration, TTLs, and Validity
Security aware servers MUST NOT consider SIG RRs to authenticate
anything before their signature inception or after its expiration
time (see also Section 6). Security aware servers MUST NOT consider
any RR to be authenticated after all its signatures have expired.
When a secure server caches authenticated data, if the TTL would
expire at a time further in the future than the authentication
expiration time, the server SHOULD trim the TTL in the cache entry
not to extent beyond the authentication expiration time. Within
these constraints, servers should continue to follow DNS TTL aging.
Thus authoritative servers should continue to follow the zone refresh
and expire parameters and a non-authoritative server should count
down the TTL and discard RRs when the TTL is zero (even for a SIG
that has not yet reached its authentication expiration time). In
addition, when RRs are transmitted in a query response, the TTL
should be trimmed so that current time plus the TTL does not extend
beyond the authentication expiration time. Thus, in general, the TTL
on a transmitted RR would be
min(authExpTim,max(zoneMinTTL,min(originalTTL,currentTTL)))
When signatures are generated, signature expiration times should be
set far enough in the future that it is quite certain that new
signatures can be generated before the old ones expire. However,
setting expiration too far into the future could mean a long time to
flush any bad data or signatures that may have been generated.
It is recommended that signature lifetime be a small multiple of the
TTL (ie, 4 to 16 times the TTL) but not less than a reasonable
maximum re-signing interval and not less than the zone expiry time.
5. Non-existent Names and Types
The SIG RR mechanism described in Section 4 above provides strong
authentication of RRs that exist in a zone. But it is not clear
above how to verifiably deny the existence of a name in a zone or a
type for an existent name.
The nonexistence of a name in a zone is indicated by the NXT ("next")
RR for a name interval containing the nonexistent name. An NXT RR or
RRs and its or their SIG(s) are returned in the authority section,
along with the error, if the server is security aware. The same is
true for a non-existent type under an existing name except that there
is no error indication other than an empty answer section
accompanying the NXT(s). This is a change in the existing standard
[RFCs 1034/1035] which contemplates only NS and SOA RRs in the
authority section. NXT RRs will also be returned if an explicit query
is made for the NXT type.
The existence of a complete set of NXT records in a zone means that
any query for any name and any type to a security aware server
serving the zone will result in an reply containing at least one
signed RR unless it is a query for delegation point NS or glue A or
AAAA RRs.
5.1 The NXT Resource Record
The NXT resource record is used to securely indicate that RRs with an
owner name in a certain name interval do not exist in a zone and to
indicate what RR types are present for an existing name.
The owner name of the NXT RR is an existing name in the zone. It's
RDATA is a "next" name and a type bit map. Thus the NXT RRs in a zone
create a chain of all of the literal owner names in that zone,
including unexpanded wildcards but omitting the owner name of glue
address records unless they would otherwise be included. This implies
a canonical ordering of all domain names in a zone as described in
Section 8. The presence of the NXT RR means that no name between its
owner name and the name in its RDATA area exists and that no other
types exist under its owner name.
There is a potential problem with the last NXT in a zone as it wants
to have an owner name which is the last existing name in canonical
order, which is easy, but it is not obvious what name to put in its
RDATA to indicate the entire remainder of the name space. This is
handled by treating the name space as circular and putting the zone
name in the RDATA of the last NXT in a zone.
The NXT RRs for a zone SHOULD be automatically calculated and added
to the zone when SIGs are added. The NXT RR's TTL SHOULD NOT exceed
the zone minimum TTL.
The type number for the NXT RR is 30.
NXT RRs are only signed by zone level keys.
5.2 NXT RDATA Format
The RDATA for an NXT RR consists simply of a domain name followed by
a bit map, as shown below.
1 1 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2 2 2 3 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| next domain name /
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| type bit map /
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
The NXT RR type bit map format currently defined is one bit per RR
type present for the owner name. A one bit indicates that at least
one RR of that type is present for the owner name. A zero indicates
that no such RR is present. All bits not specified because they are
beyond the end of the bit map are assumed to be zero. Note that bit
30, for NXT, will always be on so the minimum bit map length is
actually four octets. Trailing zero octets are prohibited in this
format. The first bit represents RR type zero (an illegal type which
can not be present) and so will be zero in this format. This format
is not used if there exists an RR with a type number greater than
127. If the zero bit of the type bit map is a one, it indicates that
a different format is being used which will always be the case if a
type number greater than 127 is present.
The domain name may be compressed with standard DNS name compression
when being transmitted over the network. The size of the bit map can
be inferred from the RDLENGTH and the length of the next domain name.
5.3 Additional Complexity Due to Wildcards
Proving that a non-existent name response is correct or that a
wildcard expansion response is correct makes things a little more
complex.
In particular, when a non-existent name response is returned, an NXT
must be returned showing that the exact name queried did not exist
and, in general, one or more additional NXT's need to be returned to
also prove that there wasn't a wildcard whose expansion should have
been returned. (There is no need to return multiple copies of the
same NXT.) These NXTs, if any, are returned in the authority section
of the response.
Furthermore, if a wildcard expansion is returned in a response, in
general one or more NXTs needs to also be returned in the authority
section to prove that no more specific name (including possibly more
specific wildcards in the zone) existed on which the response should
have been based.
5.4 Example
Assume zone foo.nil has entries for
big.foo.nil,
medium.foo.nil.
small.foo.nil.
tiny.foo.nil.
Then a query to a security aware server for huge.foo.nil would
produce an error reply with an RCODE of NXDOMAIN and the authority
section data including something like the following:
foo.nil. NXT big.foo.nil NS KEY SOA NXT ;prove no *.foo.nil
foo.nil. SIG NXT 1 2 ( ;type-cov=NXT, alg=1, labels=2
19970102030405 ;signature expiration
19961211100908 ;signature inception
2143 ;key identifier
foo.nil. ;signer
AIYADP8d3zYNyQwW2EM4wXVFdslEJcUx/fxkfBeH1El4ixPFhpfHFElxbvKoWmvjDTCm
fiYy2X+8XpFjwICHc398kzWsTMKlxovpz2FnCTM= ;signature (640 bits)
)
big.foo.nil. NXT medium.foo.nil. A MX SIG NXT ;prove no huge.foo.nil
big.foo.nil. SIG NXT 1 3 ( ;type-cov=NXT, alg=1, labels=3
19970102030405 ;signature expiration
19961211100908 ;signature inception
2143 ;key identifier
foo.nil. ;signer
MxFcby9k/yvedMfQgKzhH5er0Mu/vILz45IkskceFGgiWCn/GxHhai6VAuHAoNUz4YoU
1tVfSCSqQYn6//11U6Nld80jEeC8aTrO+KKmCaY= ;signature (640 bits)
)
Note that this response implies that big.foo.nil is an existing name
in the zone and thus has other RR types associated with it than NXT.
However, only the NXT (and its SIG) RR appear in the response to this
query for huge.foo.nil, which is a non-existent name.
5.5 Special Considerations at Delegation Points
A name (other than root) which is the head of a zone also appears as
the leaf in a superzone. If both are secure, there will always be
two different NXT RRs with the same name. They can be easily
distinguished by their signers, the next domain name fields, the
presence of the SOA type bit, etc. Security aware servers should
return the correct NXT automatically when required to authenticate
the non-existence of a name and both NXTs, if available, on explicit
query for type NXT.
Non-security aware servers will never automatically return an NXT and
some old implementations may only return the NXT from the subzone on
explicit queries.
5.6 Zone Transfers
The subsections below describe how full and incremental zone
transfers are secured.
SIG RRs secure all authoritative RRs transferred for both full and
incremental [RFC1995] zone transfers. NXT RRs are an essential
element in secure zone transfers and assure that every authoritative
name and type will be present; however, if there are multiple SIGs
with the same name and type covered, a subset of the SIGs could be
sent as long as at least one is present and, in the case of unsigned
delegation point NS or glue A or AAAA RRs a subset of these RRs or
simply a modified set could be sent as long as at least one of each
type is included.
When an incremental or full zone transfer request is received with
the same or newer version number than that of the server's copy of
the zone, it is replied to with just the SOA RR of the server's
current version and the SIG RRset verifying that SOA RR.
The complete NXT chains specified in this document enable a resolver
to obtain, by successive queries chaining through NXTs, all of the
names in a zone even if zone transfers are prohibited. Different
format NXTs may be specified in the future to avoid this.
5.6.1 Full Zone Transfers
To provide server authentication that a complete transfer has
occurred, transaction authentication SHOULD be used on full zone
transfers. This provides strong server based protection for the
entire zone in transit.
5.6.2 Incremental Zone Transfers
Individual RRs in an incremental (IXFR) transfer [RFC1995] can be
verified in the same way as for a full zone transfer and the
integrity of the NXT name chain and correctness of the NXT type bits
for the zone after the incremental RR deletes and adds can check each
disjoint area of the zone updated. But the completeness of an
incremental transfer can not be confirmed because usually neither the
deleted RR section nor the added RR section has a compete zone NXT
chain. As a result, a server which securely supports IXFR must
handle IXFR SIG RRs for each incremental transfer set that it
maintains.
The IXFR SIG is calculated over the incremental zone update
collection of RRs in the order in which it is transmitted: old SOA,
then deleted RRs, then new SOA and added RRs. Within each section,
RRs must be ordered as specified in Section 8. If condensation of
adjacent incremental update sets is done by the zone owner, the
original IXFR SIG for each set included in the condensation must be
discarded and a new on IXFR SIG calculated to cover the resulting
condensed set.
The IXFR SIG really belongs to the zone as a whole, not to the zone
name. Although it SHOULD be correct for the zone name, the labels
field of an IXFR SIG is otherwise meaningless. The IXFR SIG is only
sent as part of an incremental zone transfer. After validation of
the IXFR SIG, the transferred RRs MAY be considered valid without
verification of the internal SIGs if such trust in the server
conforms to local policy.
6. How to Resolve Securely and the AD and CD Bits
Retrieving or resolving secure data from the Domain Name System (DNS)
involves starting with one or more trusted public keys that have been
staticly configured at the resolver. With starting trusted keys, a
resolver willing to perform cryptography can progress securely
through the secure DNS structure to the zone of interest as described
in Section 6.3. Such trusted public keys would normally be configured
in a manner similar to that described in Section 6.2. However, as a
practical matter, a security aware resolver would still gain some
confidence in the results it returns even if it was not configured
with any keys but trusted what it got from a local well known server
as if it were staticly configured.
Data stored at a security aware server needs to be internally
categorized as Authenticated, Pending, or Insecure. There is also a
fourth transient state of Bad which indicates that all SIG checks
have explicitly failed on the data. Such Bad data is not retained at
a security aware server. Authenticated means that the data has a
valid SIG under a KEY traceable via a chain of zero or more SIG and
KEY RRs allowed by the resolvers policies to a KEY staticly
configured at the resolver. Pending data has no authenticated SIGs
and at least one additional SIG the resolver is still trying to
authenticate. Insecure data is data which it is known can never be
either Authenticated or found Bad in the zone where it was found
because it is in or has been reached via a unsecured zone or because
it is unsigned glue address or delegation point NS data. Behavior in
terms of control of and flagging based on such data labels is
described in Section 6.1.
The proper validation of signatures requires a reasonably secure
shared opinion of the absolute time between resolvers and servers as
described in Section 6.4.
6.1 The AD and CD Header Bits
Two previously unused bits are allocated out of the DNS
query/response format header. The AD (authentic data) bit indicates
in a response that all the data included in the answer and authority
portion of the response has been authenticated by the server
according to the policies of that server. The CD (checking disabled)
bit indicates in a query that Pending (non-authenticated) data is
acceptable to the resolver sending the query.
These bits are allocated from the previously must-be-zero Z field as
follows:
1 1 1 1 1 1
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
| ID |
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
|QR| Opcode |AA|TC|RD|RA| Z|AD|CD| RCODE |
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
| QDCOUNT |
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
| ANCOUNT |
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
| NSCOUNT |
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
| ARCOUNT |
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
These bits are zero in old servers and resolvers. Thus the responses
of old servers are not flagged as authenticated to security aware
resolvers and queries from non-security aware resolvers do not assert
the checking disabled bit and thus will be answered by security aware
servers only with Authenticated or Insecure data. Security aware
resolvers MUST NOT trust the AD bit unless they trust the server they
are talking to and either have a secure path to it or use DNS
transaction security.
Any security aware resolver willing to do cryptography SHOULD assert
the CD bit on all queries to permit it to impose its own policies and
to reduce DNS latency time by allowing security aware servers to
answer with Pending data.
Security aware servers MUST NOT return Bad data. For non-security
aware resolvers or security aware resolvers requesting service by
having the CD bit clear, security aware servers MUST return only
Authenticated or Insecure data in the answer and authority sections
with the AD bit set in the response. Security aware servers SHOULD
return Pending data, with the AD bit clear in the response, to
security aware resolvers requesting this service by asserting the CD
bit in their request. The AD bit MUST NOT be set on a response
unless all of the RRs in the answer and authority sections of the
response are either Authenticated or Insecure. The AD bit does not
cover the additional information section.
6.2 Staticly Configured Keys
The public key to authenticate a zone SHOULD be defined in local
configuration files before that zone is loaded at the primary server
so the zone can be authenticated.
While it might seem logical for everyone to start with a public key
associated with the root zone and staticly configure this in every
resolver, this has problems. The logistics of updating every DNS
resolver in the world should this key ever change would be severe.
Furthermore, many organizations will explicitly wish their "interior"
DNS implementations to completely trust only their own DNS servers.
Interior resolvers of such organizations can then go through the
organization's zone servers to access data outside the organization's
domain and need not be configured with keys above the organization's
DNS apex.
Host resolvers that are not part of a larger organization may be
configured with a key for the domain of their local ISP whose
recursive secure DNS caching server they use.
6.3 Chaining Through The DNS
Starting with one or more trusted keys for any zone, it should be
possible to retrieve signed keys for that zone's subzones which have
a key. A secure sub-zone is indicated by a KEY RR with non-null key
information appearing with the NS RRs in the sub-zone and which may
also be present in the parent. These make it possible to descend
within the tree of zones.
6.3.1 Chaining Through KEYs
In general, some RRset that you wish to validate in the secure DNS
will be signed by one or more SIG RRs. Each of these SIG RRs has a
signer under whose name is stored the public KEY to use in
authenticating the SIG. Each of those KEYs will, generally, also be
signed with a SIG. And those SIGs will have signer names also
referring to KEYs. And so on. As a result, authentication leads to
chains of alternating SIG and KEY RRs with the first SIG signing the
original data whose authenticity is to be shown and the final KEY
being some trusted key staticly configured at the resolver performing
the authentication.
In testing such a chain, the validity periods of the SIGs encountered
must be intersected to determine the validity period of the
authentication of the data, a purely algorithmic process. In
addition, the validation of each SIG over the data with reference to
a KEY must meet the objective cryptographic test implied by the
cryptographic algorithm used (although even here the resolver may
have policies as to trusted algorithms and key lengths). Finally,
the judgement that a SIG with a particular signer name can
authenticate data (possibly a KEY RRset) with a particular owner
name, is primarily a policy question. Ultimately, this is a policy
local to the resolver and any clients that depend on that resolver's
decisions. It is, however, recommended, that the policy below be
adopted:
Let A < B mean that A is a shorter domain name than B formed by
dropping one or more whole labels from the left end of B, i.e.,
A is a direct or indirect superdomain of B. Let A = B mean that
A and B are the same domain name (i.e., are identical after
letter case canonicalization). Let A > B mean that A is a
longer domain name than B formed by adding one or more whole
labels on the left end of B, i.e., A is a direct or indirect
subdomain of B
Let Static be the owner names of the set of staticly configured
trusted keys at a resolver.
Then Signer is a valid signer name for a SIG authenticating an
RRset (possibly a KEY RRset) with owner name Owner at the
resolver if any of the following three rules apply:
(1) Owner > or = Signer (except that if Signer is root, Owner
must be root or a top level domain name). That is, Owner is the
same as or a subdomain of Signer.
(2) ( Owner < Signer ) and ( Signer > or = some Static ). That
is, Owner is a superdomain of Signer and Signer is staticly
configured or a subdomain of a staticly configured key.
(3) Signer = some Static. That is, the signer is exactly some
staticly configured key.
Rule 1 is the rule for descending the DNS tree and includes a special
prohibition on the root zone key due to the restriction that the root
zone be only one label deep. This is the most fundamental rule.
Rule 2 is the rule for ascending the DNS tree from one or more
staticly configured keys. Rule 2 has no effect if only root zone
keys are staticly configured.
Rule 3 is a rule permitting direct cross certification. Rule 3 has
no effect if only root zone keys are staticly configured.
Great care should be taken that the consequences have been fully
considered before making any local policy adjustments to these rules
(other than dispensing with rules 2 and 3 if only root zone keys are
staticly configured).
6.3.2 Conflicting Data
It is possible that there will be multiple SIG-KEY chains that appear
to authenticate conflicting RRset answers to the same query. A
resolver should choose only the most reliable answer to return and
discard other data. This choice of most reliable is a matter of
local policy which could take into account differing trust in
algorithms, key sizes, staticly configured keys, zones traversed,
etc. The technique given below is recommended for taking into
account SIG-KEY chain length.
A resolver should keep track of the number of successive secure zones
traversed from a staticly configured key starting point to any secure
zone it can reach. In general, the lower such a distance number is,
the greater the confidence in the data. Staticly configured data
should be given a distance number of zero. If a query encounters
different Authenticated data for the same query with different
distance values, that with a larger value should be ignored unless
some other local policy covers the case.
A security conscious resolver should completely refuse to step from a
secure zone into a unsecured zone unless the unsecured zone is
certified to be non-secure by the presence of an authenticated KEY RR
for the unsecured zone with the no-key type value. Otherwise the
resolver is getting bogus or spoofed data.
If legitimate unsecured zones are encountered in traversing the DNS
tree, then no zone can be trusted as secure that can be reached only
via information from such non-secure zones. Since the unsecured zone
data could have been spoofed, the "secure" zone reached via it could
be counterfeit. The "distance" to data in such zones or zones
reached via such zones could be set to 256 or more as this exceeds
the largest possible distance through secure zones in the DNS.
6.4 Secure Time
Coordinated interpretation of the time fields in SIG RRs requires
that reasonably consistent time be available to the hosts
implementing the DNS security extensions.
A variety of time synchronization protocols exist including the
Network Time Protocol (NTP [RFC1305, 2030]). If such protocols are
used, they MUST be used securely so that time can not be spoofed.
Otherwise, for example, a host could get its clock turned back and
might then believe old SIG RRs, and the data they authenticate, which
were valid but are no longer.
7. ASCII Representation of Security RRs
This section discusses the format for master file and other ASCII
presentation of the three DNS security resource records.
The algorithm field in KEY and SIG RRs can be represented as either
an unsigned integer or symbolicly. The following initial symbols are
defined as indicated:
Value Symbol
001 RSAMD5
002 DH
003 DSA
004 ECC
252 INDIRECT
253 PRIVATEDNS
254 PRIVATEOID
7.1 Presentation of KEY RRs
KEY RRs may appear as single logical lines in a zone data master file
[RFC1033].
The flag field is represented as an unsigned integer or a sequence of
mnemonics as follows separated by instances of the verticle bar ("|")
character:
BIT Mnemonic Explanation
0-1 key type
NOCONF =1 confidentiality use prohibited
NOAUTH =2 authentication use prohibited
NOKEY =3 no key present
2 FLAG2 - reserved
3 EXTEND flags extension
4 FLAG4 - reserved
5 FLAG5 - reserved
6-7 name type
USER =0 (default, may be omitted)
ZONE =1
HOST =2 (host or other end entity)
NTYP3 - reserved
8 FLAG8 - reserved
9 FLAG9 - reserved
10 FLAG10 - reserved
11 FLAG11 - reserved
12-15 signatory field, values 0 to 15
can be represented by SIG0, SIG1, ... SIG15
No flag mnemonic need be present if the bit or field it represents is
zero.
The protocol octet can be represented as either an unsigned integer
or symbolicly. The following initial symbols are defined:
000 NONE
001 TLS
002 EMAIL
003 DNSSEC
004 IPSEC
255 ALL
Note that if the type flags field has the NOKEY value, nothing
appears after the algorithm octet.
The remaining public key portion is represented in base 64 (see
Appendix A) and may be divided up into any number of white space
separated substrings, down to single base 64 digits, which are
concatenated to obtain the full signature. These substrings can span
lines using the standard parenthesis.
Note that the public key may have internal sub-fields but these do
not appear in the master file representation. For example, with
algorithm 1 there is a public exponent size, then a public exponent,
and then a modulus. With algorithm 254, there will be an OID size,
an OID, and algorithm dependent information. But in both cases only a
single logical base 64 string will appear in the master file.
7.2 Presentation of SIG RRs
A data SIG RR may be represented as a single logical line in a zone
data file [RFC1033] but there are some special considerations as
described below. (It does not make sense to include a transaction or
request authenticating SIG RR in a file as they are a transient
authentication that covers data including an ephemeral transaction
number and so must be calculated in real time.)
There is no particular problem with the signer, covered type, and
times. The time fields appears in the form YYYYMMDDHHMMSS where YYYY
is the year, the first MM is the month number (01-12), DD is the day
of the month (01-31), HH is the hour in 24 hours notation (00-23),
the second MM is the minute (00-59), and SS is the second (00-59).
The original TTL field appears as an unsigned integer.
If the original TTL, which applies to the type signed, is the same as
the TTL of the SIG RR itself, it may be omitted. The date field
which follows it is larger than the maximum possible TTL so there is
no ambiguity.
The "labels" field appears as an unsigned integer.
The key tag appears as an unsigned number.
However, the signature itself can be very long. It is the last data
field and is represented in base 64 (see Appendix A) and may be
divided up into any number of white space separated substrings, down
to single base 64 digits, which are concatenated to obtain the full
signature. These substrings can be split between lines using the
standard parenthesis.
7.3 Presentation of NXT RRs
NXT RRs do not appear in original unsigned zone master files since
they should be derived from the zone as it is being signed. If a
signed file with NXTs added is printed or NXTs are printed by
debugging code, they appear as the next domain name followed by the
RR type present bits as an unsigned interger or sequence of RR
mnemonics.
8. Canonical Form and Order of Resource Records
This section specifies, for purposes of domain name system (DNS)
security, the canonical form of resource records (RRs), their name
order, and their overall order. A canonical name order is necessary
to construct the NXT name chain. A canonical form and ordering
within an RRset is necessary in consistently constructing and
verifying SIG RRs. A canonical ordering of types within a name is
required in connection with incremental transfer (Section 5.6.2).
8.1 Canonical RR Form
For purposes of DNS security, the canonical form for an RR is the
wire format of the RR with domain names (1) fully expanded (no name
compression via pointers), (2) all domain name letters set to lower
case, (3) owner name wild cards in master file form (no substitution
made for *), and (4) the original TTL substituted for the current
TTL.
8.2 Canonical DNS Name Order
For purposes of DNS security, the canonical ordering of owner names
is to sort individual labels as unsigned left justified octet strings
where the absence of a octet sorts before a zero value octet and
upper case letters are treated as lower case letters. Names in a
zone are sorted by sorting on the highest level label and then,
within those names with the same highest level label by the next
lower label, etc. down to leaf node labels. Within a zone, the zone
name itself always exists and all other names are the zone name with
some prefix of lower level labels. Thus the zone name itself always
sorts first.
Example:
foo.example
a.foo.example
yljkjljk.a.foo.example
Z.a.foo.example
zABC.a.FOO.EXAMPLE
z.foo.example
*.z.foo.example
\200.z.foo.example
8.3 Canonical RR Ordering Within An RRset
Within any particular owner name and type, RRs are sorted by RDATA as
a left justified unsigned octet sequence where the absence of an
octet sorts before the zero octet.
8.4 Canonical Ordering of RR Types
When RRs of the same name but different types must be ordered, they
are ordered by type, considering the type to be an unsigned integer,
except that SIG RRs are placed immediately after the type they cover.
Thus, for example, an A record would be put before an MX record
because A is type 1 and MX is type 15 but if both were signed, the
order would be A < SIG(A) < MX < SIG(MX).
9. Conformance
Levels of server and resolver conformance are defined below.
9.1 Server Conformance
Two levels of server conformance for DNS security are defined as
follows:
BASIC: Basic server compliance is the ability to store and retrieve
(including zone transfer) SIG, KEY, and NXT RRs. Any secondary or
caching server for a secure zone MUST have at least basic compliance
and even then some things, such as secure CNAMEs, will not work
without full compliance.
FULL: Full server compliance adds the following to basic compliance:
(1) ability to read SIG, KEY, and NXT RRs in zone files and (2)
ability, given a zone file and private key, to add appropriate SIG
and NXT RRs, possibly via a separate application, (3) proper
automatic inclusion of SIG, KEY, and NXT RRs in responses, (4)
suppression of CNAME following on retrieval of the security type RRs,
(5) recognize the CD query header bit and set the AD query header
bit, as appropriate, and (6) proper handling of the two NXT RRs at
delegation points. Primary servers for secure zones MUST be fully
compliant and for complete secure operation, all secondary, caching,
and other servers handling the zone SHOULD be fully compliant as
well.
9.2 Resolver Conformance
Two levels of resolver compliance (including the resolver portion of
a server) are defined for DNS Security:
BASIC: A basic compliance resolver can handle SIG, KEY, and NXT RRs
when they are explicitly requested.
FULL: A fully compliant resolver (1) understands KEY, SIG, and NXT
RRs including verification of SIGs at least for the mandatory
algorithm, (2) maintains appropriate information in its local caches
and database to indicate which RRs have been authenticated and to
what extent they have been authenticated, (3) performs additional
queries as necessary to attempt to obtain KEY, SIG, or NXT RRs when
needed, (4) normally sets the CD query header bit on its queries.
10. Security Considerations
This document specifies extensions to the Domain Name System (DNS)
protocol to provide data integrity and data origin authentication,
public key distribution, and optional transaction and request
security.
It should be noted that, at most, these extensions guarantee the
validity of resource records, including KEY resource records,
retrieved from the DNS. They do not magically solve other security
problems. For example, using secure DNS you can have high confidence
in the IP address you retrieve for a host name; however, this does
not stop someone for substituting an unauthorized host at that
address or capturing packets sent to that address and falsely
responding with packets apparently from that address. Any reasonably
complete security system will require the protection of many
additional facets of the Internet beyond DNS.
The implementation of NXT RRs as described herein enables a resolver
to determine all the names in a zone even if zone transfers are
prohibited (section 5.6). This is an active area of work and may
change.
A number of precautions in DNS implementation have evolved over the
years to harden the insecure DNS against spoofing. These precautions
should not be abandoned but should be considered to provide
additional protection in case of key compromise in secure DNS.
11. IANA Considerations
KEY RR flag bits 2 and 8-11 and all flag extension field bits can be
assigned by IETF consensus as defined in RFC2434. The remaining
values of the NAMTYP flag field and flag bits 4 and 5 (which could
conceivably become an extension of the NAMTYP field) can only be
assigned by an IETF Standards Action [RFC2434].
Algorithm numbers 5 through 251 are available for assignment should
sufficient reason arise. However, the designation of a new algorithm
could have a major impact on interoperability and requires an IETF
Standards Action [RFC2434]. The existence of the private algorithm
types 253 and 254 should satify most needs for private or proprietary
algorithms.
Additional values of the Protocol Octet (5-254) can be assigned by
IETF Consensus [RFC2434].
The meaning of the first bit of the NXT RR "type bit map" being a one
can only be assigned by a standards action.
References
[RFC1033] Lottor, M., "Domain Administrators Operations Guide", RFC
1033, November 1987.
[RFC1034] Mockapetris, P., "Domain Names - Concepts and
Facilities", STD 13, RFC1034, November 1987.
[RFC1035] Mockapetris, P., "Domain Names - Implementation and
Specifications", STD 13, RFC1035, November 1987.
[RFC1305] Mills, D., "Network Time Protocol (v3)", RFC1305, March
1992.
[RFC1530] Malamud, C. and M. Rose, "Principles of Operation for the
TPC.INT Subdomain: General Principles and Policy", RFC
1530, October 1993.
[RFC2401] Kent, S. and R. Atkinson, "Security Architecture for the
Internet Protocol", RFC2401, November 1998.
[RFC1982] Elz, R. and R. Bush, "Serial Number Arithmetic", RFC
1982, September 1996.
[RFC1995] Ohta, M., "Incremental Zone Transfer in DNS", RFC1995,
August 1996.
[RFC2030] Mills, D., "Simple Network Time Protocol (SNTP) Version 4
for IPv4, IPv6 and OSI", RFC2030, October 1996.
[RFC2045] Freed, N. and N. Borenstein, "Multipurpose Internet Mail
Extensions (MIME) Part One: Format of Internet Message
Bodies", RFC2045, November 1996.
[RFC2065] Eastlake, D. and C. Kaufman, "Domain Name System Security
Extensions", RFC2065, January 1997.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC2119, March 1997.
[RFC2136] Vixie, P., Thomson, S., Rekhter, Y. and J. Bound,
"Dynamic Updates in the Domain Name System (DNS UPDATE)",
RFC2136, April 1997.
[RFC2137] Eastlake, D., "Secure Domain Name System Dynamic Update",
RFC2137, April 1997.
[RFC2181] Elz, R. and R. Bush, "Clarifications to the DNS
Specification", RFC2181, July 1997.
[RFC2434] Narten, T. and H. Alvestrand, "Guidelines for Writing an
IANA Considerations Section in RFCs", BCP 26, RFC2434,
October 1998.
[RFC2537] Eastlake, D., "RSA/MD5 KEYs and SIGs in the Domain Name
System (DNS)", RFC2537, March 1999.
[RFC2539] Eastlake, D., "Storage of Diffie-Hellman Keys in the
Domain Name System (DNS)", RFC2539, March 1999.
[RFC2536] Eastlake, D., "DSA KEYs and SIGs in the Domain Name
System (DNS)", RFC2536, March 1999.
[RFC2538] Eastlake, D. and O. Gudmundsson, "Storing Certificates in
the Domain Name System", RFC2538, March 1999.
[RFC2541] Eastlake, D., "DNS Operational Security Considerations",
RFC2541, March 1999.
[RSA FAQ] - RSADSI Frequently Asked Questions periodic posting.
Author's Address
Donald E. Eastlake 3rd
IBM
65 Shindegan Hill Road
RR #1
Carmel, NY 10512
Phone: +1-914-784-7913 (w)
+1-914-276-2668 (h)
Fax: +1-914-784-3833 (w-fax)
EMail: dee3@us.ibm.com
Appendix A: Base 64 Encoding
The following encoding technique is taken from [RFC2045] by N.
Borenstein and N. Freed. It is reproduced here in an edited form for
convenience.
A 65-character subset of US-ASCII is used, enabling 6 bits to be
represented per printable character. (The extra 65th character, "=",
is used to signify a special processing function.)
The encoding process represents 24-bit groups of input bits as output
strings of 4 encoded characters. Proceeding from left to right, a
24-bit input group is formed by concatenating 3 8-bit input groups.
These 24 bits are then treated as 4 concatenated 6-bit groups, each
of which is translated into a single digit in the base 64 alphabet.
Each 6-bit group is used as an index into an array of 64 printable
characters. The character referenced by the index is placed in the
output string.
Table 1: The Base 64 Alphabet
Value Encoding Value Encoding Value Encoding Value Encoding
0 A 17 R 34 i 51 z
1 B 18 S 35 j 52 0
2 C 19 T 36 k 53 1
3 D 20 U 37 l 54 2
4 E 21 V 38 m 55 3
5 F 22 W 39 n 56 4
6 G 23 X 40 o 57 5
7 H 24 Y 41 p 58 6
8 I 25 Z 42 q 59 7
9 J 26 a 43 r 60 8
10 K 27 b 44 s 61 9
11 L 28 c 45 t 62 +
12 M 29 d 46 u 63 /
13 N 30 e 47 v
14 O 31 f 48 w (pad) =
15 P 32 g 49 x
16 Q 33 h 50 y
Special processing is performed if fewer than 24 bits are available
at the end of the data being encoded. A full encoding quantum is
always completed at the end of a quantity. When fewer than 24 input
bits are available in an input group, zero bits are added (on the
right) to form an integral number of 6-bit groups. Padding at the
end of the data is performed using the '=' character. Since all base
64 input is an integral number of octets, only the following cases
can arise: (1) the final quantum of encoding input is an integral
multiple of 24 bits; here, the final unit of encoded output will be
an integral multiple of 4 characters with no "=" padding, (2) the
final quantum of encoding input is exactly 8 bits; here, the final
unit of encoded output will be two characters followed by two "="
padding characters, or (3) the final quantum of encoding input is
exactly 16 bits; here, the final unit of encoded output will be three
characters followed by one "=" padding character.
Appendix B: Changes from RFC2065
This section summarizes the most important changes that have been
made since RFC2065.
1. Most of Section 7 of [RFC2065] called "Operational
Considerations", has been removed and may be made into a separate
document [RFC2541].
2. The KEY RR has been changed by (2a) eliminating the "experimental"
flag as unnecessary, (2b) reserving a flag bit for flags
expansion, (2c) more compactly encoding a number of bit fields in
such a way as to leave unchanged bits actually used by the limited
code currently deployed, (2d) eliminating the IPSEC and email flag
bits which are replaced by values of the protocol field and adding
a protocol field value for DNS security itself, (2e) adding
material to indicate that zone KEY RRs occur only at delegation
points, and (2f) removing the description of the RSA/MD5 algorithm
to a separate document [RFC2537]. Section 3.4 describing the
meaning of various combinations of "no-key" and key present KEY
RRs has been added and the secure / unsecure status of a zone has
been clarified as being per algorithm.
3. The SIG RR has been changed by (3a) renaming the "time signed"
field to be the "signature inception" field, (3b) clarifying that
signature expiration and inception use serial number ring
arithmetic, (3c) changing the definition of the key footprint/tag
for algorithms other than 1 and adding Appendix C to specify its
calculation. In addition, the SIG covering type AXFR has been
eliminated while one covering IXFR [RFC1995] has been added (see
section 5.6).
4. Algorithm 3, the DSA algorithm, is now designated as the mandatory
to implement algorithm. Algorithm 1, the RSA/MD5 algorithm, is
now a recommended option. Algorithm 2 and 4 are designated as the
Diffie-Hellman key and elliptic cryptography algorithms
respectively, all to be defined in separate documents. Algorithm