DNSSEC policy.

[rthalley]

An idea for DNSSEC policy enforcement

[jschlyter]

I like this, very clean and easy to extend. It doesn't differs between MAY and NOT RECOMMENDED though, but one can create such a policy later if needed.

[rthalley]

Just a note that I will write documentation and otherwise polish things a bit more if we go in this direction.

[pspacek]

I like this too. Two notes:

• It would be awesome if it could check other parameters, like RSA bitlength. I mean - 512-bit RSA is not good anymore, while 2048 bit is okay if you have to use it.
• Maybe two-state result is not enough - some people in the past advocated for DONT_USE_AT_ALL/INSECURE_ONLY/OKAY_TO_USE states, where weak combinations of parameters (be it 512-bit RSA or SHA1) fall into category "INSECURE_ONLY" - if you do validation you can effectively get only INSECURE (if it passes validation) or BOGUS (if there is a problem).

The logic behind this is skipping validation is not doing any good, and that real threat is in saying "it's secure" when it's really not that much secure anymore.

Uh huh, that's a long post. Does it make any sense?

[rthalley]

Hmm, maybe I should I have the policy take the whole DNSKEY for the signing and validation check. Then you can subclass Policy and add length checks for RSA etc.

I didn't go for more complex states like "NOT RECOMMENDED" as I wanted to use this in the actual signing and validation code, and all it cares about is "should I or shouldn't I?" I suppose I could have had policy in the policy about how to deal with more complex recommendations, but it seemed just as easy to say "make another policy object if you want a different policy".

Aside: personally I don't like the concept of INSECURE_ONLY as an automatic response to inadequate crypto, as it is hiding the inadequacy from the zone owner. I'd rather that things failed hard in such a case, but had a manual workaround, like installing a "negative trust anchor".

[pspacek]

Taking in whole DNSKEY sounds reasonable! FTR I'm not sold to the INSECURE_ONLY idea, I just wanted to make sure it was considered.