Subject: DNSSEC and empty nodes

From: [email-masked]
Date: Sat, 10 Apr 1999 11:04:52 +1000

I believe how we generate NXT records is conceptually flawed.

	Take the following senario:

		example SOA ...
		example NS ...
		aaa.example A ...
		ccc.bbb.example A ...

	when generating NXT records (as it currently stands) we would generate

		example NXT aaa.example NS SOA NXT
		aaa.example NXT ccc.bbb.example A NXT
		ccc.bbb.example NXT example A NXT

	This results in a change from current behaviour when looking up
	bbb.example, NOERROR->NXDOMAIN.

	Now the DNS is described as a tree structure and a tree can have
	empty nodes.

	Now the example above has three explict nodes and one implicit
	node.  When generating NXT records we should be taking into account
	the implicit nodes.

		example NXT aaa.example NS SOA NXT
		aaa.example NXT bbb.example A NXT
		bbb.example NXT ccc.bbb.example NXT
		ccc.bbb.example NXT example A NXT

	Also currently I can lookup bbb.example and know whether there are
	records below bbb.example just by looking at the RCODE, now I would
	need to look at the NXT record as well.

	Mark
-- 
Mark Andrews, Internet Software Consortium
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE:	+61 2 9871 4742		         INTERNET: [email-masked]

---

From: "Matt Crawford" <[email-masked]>
Date: Mon, 12 Apr 1999 14:14:11 -0500

I thought I understood dnssec, but I just don't follow this claim.

> 	bbb.example, NOERROR->NXDOMAIN.

No NXT's appear at owner-names which don't have any other data, so I
don't see how the return code can change.  Bbb.example was empty in
the insecure zone, and it's empty in the secured zone.  The example
in section 5.4 of RFC 2535 had an NXDOMAIN, but it didn't have an
empty intermediate node like yours does.

> 	need to look at the NXT record as well.

If you care about security, you have to look at the NXT and its SIG
anyway.
				Matt