Let me apologise in advance of this question has been answered. I did have a good look and if it is here somewhere I missed it. My question hopes to clarify exactly what happens when a validating resolver queries a DNSSEC aware nameserver for a RR. I thought I understood the process, then I read an explanation written by someone I would think can speak authoritatively (no pun intended) on the subject. I think the easiest way for me to do this is to explain what I thought the process looked like and then the contrasting version. And hopefully someone among you all will be able to clarify where I might be going wrong. Example A (or how I thought a DNSSEC query worked):
Host A sends a query to it's recursive caching DNS server for www.example.com The recursive server sends an iterative query to a DNS server that is authoritative for the root zone The root DNS server can't answer the query directly so it responds with:
A plain text referral for the authoritative name servers for the com zone
RRset of DNSKey records for the root zone (the root zone's PubKSK and PubZSK)
RRSig of the above DNSKey RRSet signed with the root zone's PvtKSK
DS record for the com zone (hash of the com zone's PubKSK)
RRSig of the above DS record (signed using the root zone's PvtZSK)
The recursive caching server hold's a copy of the Root zone's PubKSK so it verifies the above files as follows:
The RRSig containing Root zone's DNSkey record is decrypted using the Root zone PubKSK (already held)
The hash of the Root PubKSK from the RRSig is compared to a hash of the Root PubKSK already held by the recursive server, to verify the authenticity of the key.
If the hashes match the key is trusted and therefore the Root PubZSK is also trusted and can be used to decrypt the RRSig of the DS record for the com zone
Once descrypted the hash of the come zone's PubKSK is compared to that in the DS record to verify that the com PubKSK can be trusted.
This has been my understanding of how the trust chain works. Now that the recursive server holds the com zone PubKSK the process is repeated, down to the example nameservers which respond with the IP for the web server for that domain.
Example B:
I recently read Josh Reed's explanation of a query in para. 1.5 'How Does DNSSEC Change DNS LOOKUP?' on users.isc.org and he explains it almost in reverse.
In his explanation:
Host A queries it's recursive resolver for info on the web server www.isc.org
The recursive server's requests on behalf of Host A will be answered by the name-servers responsible for isc.org and contain the records required by DNSSEC.
Validation now begins when the recursive resolver asks the isc.org name-server for the keys for it's zone. Once those keys are provided then the recursive server then queries up (the parent) to validate responses in reverse fashion to Example A, until a trusted key (presumably or typically from the root) confirms that the chain can be trusted.
The question:
Can I trouble someone with a better understanding to confirm that my understanding (as explained in Example A) is incorrect. I don't doubt Josh Reed but the second example seems to be less efficient.
Any and all comments would be welcome :-)
