RFC 2137
Secure Domain Name System Dynamic Update
RFC 2137: Secure Domain Name System Dynamic Update 🎀
Okay so bestie, this one is from the Network Working Group 🌸 and it's written by D. Eastlake 3rd of CyberCash, Inc. 💅 It's dated April 1997 📅 and it's on the Standards Track, so it's a real protocol spec, not a vibe check. It updates RFC 1035 (that's the only thing it's listed as touching in its header). It's giving serious standards-body energy but the content is so good 😭
Status of this Memo ✨
Ngl, the status part is basically the fine print. This doc is an Internet standards track protocol for the Internet community, and it's openly asking for discussion and suggestions for improvements 🫶 If you want the current standardization state, you check the "Internet Official Protocol Standards" (STD 1) list. And yes, distribution of this memo is unlimited 🦋
Abstract 🔥
So the big idea is that DNS already got protocol extensions to authenticate the data it stores and to handle key distribution [RFC2065] 🔐 DNS Dynamic Update was also defined [RFC2136], but the security for the update operation was kinda missing, lowkey a big gap 💀 This memo fills it in by using DNSSEC digital signatures that cover both the requests and the data. The result is that updates are secured and limited to whoever can prove they hold the right cryptographic keys 👑
Acknowledgements 🧚
Shoutout to these legends, listed alphabetically, for their contributions:
Olafur Gudmundsson (ogud@tis.com>
Charlie Kaufman <Charlie_Kaufman@iris.com>
Stuart Kwan <skwan@microsoft.com>
Edward Lewis <lewis@tis.com>Table of Contents 🍓
1. Introduction............................................2
1.1 Overview of DNS Dynamic Update.........................2
1.2 Overview of DNS Security...............................2
2. Two Basic Modes.........................................3
3. Keys....................................................5
3.1 Update Keys............................................6
3.1.1 Update Key Name Scope................................6
3.1.2 Update Key Class Scope...............................6
3.1.3 Update Key Signatory Field...........................6
3.2 Zone Keys and Update Modes.............................8
3.3 Wildcard Key Punch Through.............................9
4. Update Signatures.......................................9
4.1 Update Request Signatures..............................9
4.2 Update Data Signatures................................10
5. Security Considerations................................10
References................................................10
Author's Address..........................................111. Introduction 💖
Okay so dynamic update operations got defined for DNS in RFC 2136, but the security stuff for those updates wasn't spelled out in detail 🙈 The ways to secure DNS and use it for key distribution came from RFC 2065 ✨
This memo proposes techniques built on those DNS security mechanisms to authenticate DNS updates. It assumes you already know the DNS system [RFC 1034, 1035] 📚 And it helps a ton if you're familiar with the DNS security and dynamic update proposals too 🧠
1.1 Overview of DNS Dynamic Update 🦋
DNS dynamic update adds a new DNS opcode, a new request and response structure for when that opcode is used, and new error codes 🎀 An update can do complex mixes of deleting and inserting resource records (RRs) with one or more owner names, and you can do those with or without pre-existence testing. BUT (and this is the important part) all the testing and changes in a single update request are limited to one zone. Updates happen at the primary server for a zone 🏠
The primary server for a secure dynamic zone MUST increment the zone SOA serial number when an update occurs. It can also do it the next time the SOA gets retrieved, as long as one or more updates happened since the last SOA retrieval and those updates didn't touch the SOA themselves 🔢
1.2 Overview of DNS Security 🔐
So DNS security authenticates the data by also storing digital signatures in the DNS, as SIG resource records (RRs) 🖊️ A SIG RR signs the whole set of RRs that share its owner name and class and that have the type the SIG covers. It binds that covered RR set to the signer, the time it was signed, the signature expiration date, and more ✨
Every secure zone has one or more keys, and all the data in that zone is signed either by a zone key or by a dynamic update key that traces its authority back to a zone key 👑
DNS security also has transaction SIGs and request SIGs 🫶 Transaction SIGs show up at the end of a response. They authenticate the response and tie it to the matching request, using the key of the host where the responding DNS server lives. Request SIGs show up at the end of a request and authenticate the request using the key of whoever submitted it 💅
Request SIGs are the main way update requests get authenticated. Period 🔥
DNS security also lets you store public keys in the DNS through KEY RRs. Those KEY RRs are authenticated by SIG RRs too, of course 🌈 KEY RRs for zones get stored in their superzone and subzone servers (if there are any), so that a security aware resolver can walk through the secure tree of zones 🌳
2. Two Basic Modes 🌸
A dynamic secure zone is any secure DNS zone that has one or more KEY RRs that can authorize dynamic updates. Those are entity or user KEY RRs with a non-zero signatory field, and the zone KEY RR's signatory field has to say that updates are implemented ✨ There are two basic modes for a dynamic secure zone, based on update strategy: mode A and mode B. Here's a summary comparison table, and then we'll go through each mode 💖
SUMMARY OF DYNAMIC SECURE ZONE MODES
CRITERIA: | MODE A | MODE B
=========================+====================+===================
Definition: | Zone Key Off line | Zone Key On line
=========================+====================+===================
Server Workload | Low | High
-------------------------+--------------------+-------------------
Static Data Security | Very High | Medium-High
-------------------------+--------------------+-------------------
Dynamic Data Security | Medium | Medium-High
-------------------------+--------------------+-------------------
Key Restrictions | Fine grain | Coarse grain
-------------------------+--------------------+-------------------
Dynamic Data Temporality | Transient | Permanent
-------------------------+--------------------+-------------------
Dynamic Key Rollover | No | Yes
-------------------------+--------------------+-------------------Mode A 🧁
In mode A, the zone owner key and the static zone master file are always kept off-line, for maximum security of the static zone contents 🔒
So here's the deal: any dynamically added or changed RRs get signed in the secure zone by the dynamic update key that authorized them. Those get backed up, along with their SIG RR, in a separate online dynamic master file 💾 Server computation stays low because the server only has to check signatures on the update data and request, and those were already signed by the updater. Checking is generally a way faster operation than signing 🏎️
BUT, the AXFR SIG and the NXT RRs that cover the zone under the zone key do NOT cover dynamically added data 💀 So for type A dynamic secure zones, zone transfer security isn't automatically provided for dynamically added RRs (they could just be left out), and authentication isn't provided for the server denying that a dynamically added type exists 🙅♀️
The good news: dynamically added RRs keep their update-KEY-signed SIG, so you can get finer grained control of updates through bits in the KEY RR signatory field 🎯 Also, dynamic data only lives in the online dynamic master file and is only authenticated by dynamic keys that expire, so updates are transient in nature ⏳
Key rollover for an entity that can authorize dynamic updates is more of a hassle 😩 Their key's authority has to be traceable to a zone key, so in general they MUST securely communicate a new key to the zone authority, who then transfers it manually to the off-line static master file 🗝️
NOTE: for this mode the zone SOA MUST be signed by a dynamic update key, and that private key MUST be kept on line so that the SOA can be changed for updates. ⚠️
Mode B 🌊
In mode B, the zone owner key and master file are kept on-line at the zone primary server 🖥️ When authenticated updates succeed, the SIGs under the zone key for the resulting data get calculated (including any NXT type bit map changes). Those SIG changes (and any NXT changes) get entered into the zone and the unified on-line master file 📝 The zone transfer AXFR SIG MAY be recalculated for each update, or on demand when a zone transfer is requested and it's out of date 🔄
So this mode takes a LOT more computing work on the server, because the keys are generally set up so that signing (calculating a SIG) is more effort than verifying a signature 🥵 The security of the static data in the zone goes down, since the final state of the static data being served and the ultimate zone authority private key are both online on the net. That means if the primary server gets subverted, false data could get authenticated to secondaries and other servers and resolvers 😱
On the flip side, data added dynamically is more secure here than in mode A ✨ Dynamic data is covered by the AXFR SIG, so it's always protected during zone transfers. It's also included in NXT RRs, so a server can only falsely deny it to the same extent it can deny static data (meaning, if it's inside a wildcard scope) 🃏
Because the zone key signs all the zone data, the info about who originated the current state of a dynamic RR set gets lost. That makes some of the update control bits in the KEY RR signatory field unavailable 🙃 Also, once updates are incorporated into the primary master file and authenticated by the zone key, they become permanent 🪨 And keeping the zone key online means dynamic update keys signed by the zone key can be dynamically updated too, since the zone key is around to dynamically sign new values 🔁
NOTE: The Mode A / Mode B distinction ONLY affects the validation and performance of update requests. It has no effect on retrievals. One reasonable operational scheme may be to keep a mostly static main zone operating in Mode A and have one or more dynamic subzones operating in Mode B. 🧩
3. Keys 🔑
Dynamic update requests depend on update keys, which are covered in section 3.1 below ✨ On top of that, the zone's secure dynamic update mode and the availability of some options get indicated in the zone key 💜 And finally, there's a special rule for searching for KEYs when validating updates, described in section 3.3 🦋
(Part 1 ends here. Part 2 picks up with Section 3.1 and carries on from there. 💅)
3. Keys (continued) 🔑
3.1 Update Keys
okay so every update request to a secure zone must include signatures from one or more key(s) that together can authorize that update 🔐 The DNS server that gets the request has to confirm this, so the key or keys must be available to that server and authenticated by it as a specially flagged KEY Resource Record 🎀
The scope of authority for these keys comes from their KEY RR owner name, class, and signatory field flags, which are explained below ✨ On top of that, these KEY RRs must be entity or user keys, and they can't have the authentication use prohibited bit turned on 🙅♀️ Every part of the actual update must be within the scope of at least one of the keys used for a request SIG on the update request, as described in section 4 💅
3.1.1 Update Key Name Scope
The owner name of any update authorizing KEY RR must (1) be the same as the owner name of any RRs being added or deleted, or (2) be a wildcard name that, within its extended scope (see section 3.3), includes the name of any RRs being added or deleted. Those RRs must also be in the same zone 🍓
3.1.2 Update Key Class Scope
The class of any update authorizing KEY RR must be the same as the class of any RR being added or deleted 🌸
3.1.3 Update Key Signatory Field
The four bit "signatory field" (see RFC 2065) of any update authorizing KEY RR must be non-zero 🌈 The bits mean the things described below for non-zone keys. Zone type keys are covered in section 3.2 ✨
UPDATE KEY RR SIGNATORY FIELD BITS
0 1 2 3
+-----------+-----------+-----------+-----------+
| zone | strong | unique | general |
+-----------+-----------+-----------+-----------+- Bit 0, zone control - If nonzero, this key is authorized to attach, detach, and move zones by creating and deleting NS, glue A, and zone KEY RR(s). If zero, the key can not authorize any update that would effect such RRs. This bit is meaningful for both type A and type B dynamic secure zones 🏠
- NOTE: do not confuse the "zone" signatory field bit with the "zone" key type bit. Those are different things, bestie 🙈
- Bit 1, strong update - If nonzero, this key is authorized to add and delete RRs even if there are other RRs with the same owner name and class that are authenticated by a SIG signed with a different dynamic update KEY. If zero, the key can only authorize updates where any existing RRs of the same owner and class are authenticated by a SIG using the same key. This bit is meaningful only for type A dynamic zones and is ignored in type B dynamic zones 💪
- Keeping this bit zero on multiple KEY RRs with the same or nested wildcard owner names lets multiple entities create and delete names, but they can't affect RRs with different owner names from any they created. Basically this makes two levels of dynamic update key: strong and weak. Weak keys mostly stay out of each other's way, but a strong key can interfere with any weak keys or other strong keys 🥊
- Bit 2, unique name update - If nonzero, this key is authorized to add and update RRs for only a single owner name. If there already exist RRs with one or more names signed by this key, they may be updated, but no new name can be created until the number of existing names is reduced to zero. This bit is meaningful only for mode A dynamic zones and is ignored in mode B dynamic zones. It is also meaningful only if the owner name is a wildcard. (Any dynamic update KEY with a non-wildcard name is, in effect, a unique name update key 💖)
- This bit can be used to stop a KEY from flooding a zone with new names. Paired with a local, administratively imposed limit on the number of dynamic RRs with a particular name, it can completely stop a KEY from flooding a zone with RRs 🛑
- Bit 3, general update - The general update signatory field bit has no special meaning. If the other three bits are all zero, it must be one so that the field is non-zero and the key is designated as an update key. The meaning of every value of the signatory field where the general bit is on along with one or more other signatory field bits is reserved 🧚
All of the signatory bit update authorizations described above only apply if the update is within the name and class scope from sections 3.1.1 and 3.1.2 🫶
3.2 Zone Keys and Update Modes
Zone type keys are automatically authorized to sign anything in their zone, of course, no matter what their signatory field is set to 👑 For zone keys, the signatory field bits mean something different than they do for update keys, as shown below. The signatory field MUST be zero if dynamic update is not supported for a zone, and MUST be non-zero if it is 🔥
ZONE KEY RR SIGNATORY FIELD BITS
0 1 2 3
+-----------+-----------+-----------+-----------+
| mode | strong | unique | general |
+-----------+-----------+-----------+-----------+- Bit 0, mode - This bit indicates the update mode for this zone. Zero indicates mode A, while a one indicates mode B 🦋
- Bit 1, strong update - If nonzero, this indicates that the "strong" key feature described in section 3.1.3 above is implemented and enabled for this secure zone. If zero, the feature is not available. This has no effect if the zone is a mode B secure update zone 💜
- Bit 2, unique name update - If nonzero, this indicates that the "unique name" feature described in section 3.1.3 above is implemented and enabled for this secure zone. If zero, this feature is not available. This has no effect if the zone is a mode B secure update zone 🍓
- Bit 3, general - This bit has no special meaning. If dynamic update for a zone is supported and the other bits in the zone key signatory field are zero, it must be a one. The meaning of zone keys where the signatory field has the general bit and one or more other bits on is reserved 🌷
If there are multiple dynamic update KEY RRs for a zone and the zone policy is in transition, they might have different non-zero signatory fields 🔄 In that case, the strong and unique name restrictions must be enforced for as long as there is a non-expired zone key being advertised that indicates mode A with the strong or unique name bit on, respectively. Mode B updates MUST be supported for as long as there is a non-expired zone key that indicates mode B. Mode A updates may be treated as mode B updates at server option if non-expired zone keys indicate that both are supported ✨
A server that will be executing update operations on a zone (that is, the primary master server) MUST not advertise a zone key that will attract requests for a mode or features that it can't support 🚫
3.3 Wildcard Key Punch Through
Just like a zone key is valid throughout the entire zone, update keys with wildcard names are valid throughout their extended scope within the zone 🌟 That means they stay valid for any name that would match them, even existing specific names within their apparent scope. Main character energy for wildcards 💅
If this weren't the case, then whenever a name within a wildcard scope was created by dynamic update, you'd first have to create a copy of the KEY RR with that name. Otherwise, the existence of the more specific name would hide the authorizing KEY RR and make later updates impossible 😭 An updater could create such a KEY RR but couldn't zone sign it with their authorizing signer. They would have to sign it with the same key, using the wildcard name as signer. So if you were creating, say, one hundred type A RRs authorized by a *.1.1.1.in-addr.arpa. KEY RR, without key punch through you'd need 100 As, 100 KEYs, and 200 SIGs. With key punch through you only need 100 As and 100 SIGs 🧮 Literally so much less work 🎀
4. Update Signatures ✍️
Two kinds of signatures can show up in updates. Request signatures are always required. They cover the entire request and authenticate the DNS header (including opcode, counts, etc.) as well as the data 🔏 Data signatures only appear among the RRs to be added, and they're only required for mode A operation. Both types get explained more below 💖
4.1 Update Request Signatures
An update can affect multiple owner names in a zone. Those different names might be covered by different dynamic update keys 🗝️ For every owner name affected, the updater must know a private key valid for that name (and the zone's class) and must prove it by appending request SIG RRs under each such key ✨
As specified in RFC 2065, a request signature is a SIG RR that occurs at the end of a request with a type covered field of zero. For an update, request signatures occur in the Additional information section. Each request SIG signs the entire request, including the DNS header, but excluding any other request SIG(s). The ARCOUNT in the DNS header is set to what it would be without the request SIGs 🧾
4.2 Update Data Signatures
Mode A dynamic secure zones require that the update requester provide SIG RRs that will authenticate the after update state of all RR sets that are changed by the update and are non-empty after the update 📝 These SIG RRs appear in the request as RRs to be added, and the request must delete any previous data SIG RRs that the request invalidates 🗑️
In Mode B dynamic secure zones, all zone data is authenticated by zone key SIG RRs. In this case, data signatures don't need to be included with the update 🙌 A resolver can figure out which mode an updatable secure zone is using by examining the signatory field bits of the zone KEY RR (see section 3.2) 🔍
5. Security Considerations 💀
Any zone that permits dynamic updates is inherently less secure than a static secure zone maintained offline, as recommended in RFC 2065. This is the scary part, bestie 😭 Even if nothing else, secure dynamic update requires online changes to, and re-signing of, the zone SOA resource record (RR) to increase the SOA serial number. This means that compromise of the primary server host could lead to arbitrary serial number changes 🚨
Isolating dynamic RRs into separate zones from the ones holding most static RRs can limit the damage that could happen if a dynamic zone's security is breached 🛡️
References 📚
[RFC2065] Eastlake, D., and C. Kaufman, "Domain Name System Security Extensions", RFC 2065, CyberCash, Iris, January 1997.
[RFC2136] Vixie, P., Editor, Thomson, T., Rekhter, Y., and J. Bound, "Dynamic Updates in the Domain Name System (DNS UPDATE)", RFC 2136, April 1997.
[RFC1035] Mockapetris, P., "Domain Names - Implementation and Specifications", STD 13, RFC 1035, November 1987.
[RFC1034] Mockapetris, P., "Domain Names - Concepts and Facilities", STD 13, RFC 1034, November 1987.
Author's Address 🦋
Donald E. Eastlake, 3rd
CyberCash, Inc.
318 Acton Street
Carlisle, MA 01741 USA
Phone: +1 508-287-4877
+1 508-371-7148 (fax)
+1 703-620-4200 (main office, Reston, Virginia, USA)
EMail: dee@cybercash.com📦 where this page comes from
- ietf: rfc2137 1997-04
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms