Subject: Re: DNSSEC and empty nodes

From: Edward Lewis <[email-masked]>
Date: Mon, 12 Apr 1999 16:33:16 -0400

At 9:04 PM -0400 4/9/1999, [email-masked] wrote:
>	I believe how we generate NXT records is conceptually flawed.
>
...
>	node.  When generating NXT records we should be taking into account
>	the implicit nodes.
...
If we introduce NXT records for implicit nodes, then there is the problem
changing the assumption that no domain name can have just an NXT (rrset).

>	Also currently I can lookup bbb.example and know whether there are
>	records below bbb.example just by looking at the RCODE, now I would
>	need to look at the NXT record as well.

For security, you need to look at the NXT regardless of the RCODE setting.
DNSSEC does not secure the header, so relying on that opens a
vulnerability.  You have to make sure the NXT returned applies to the query
you issued.

Why are implicit nodes important when looking at NXT's?  Aren't they just a
convienence for name servers?  How do they impact the wire-protocol?  What
is the difference of a name being absent and being implicit - other than
there are other names "below" an implicit name?

Sure, if you convert an implicit node to a cut point, then you have to
rework the NXT chain, but that is to be expected.  In that case, you've
created a name and removed another (the name under the erstwhile implicit
name).

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                       Network Associates/TIS
Phone: +1 443-259-2352                             Email: [email-masked]

Think globally, scope locally.
"Trying is the first step to failure." - Homer Simpson
"No! Try not. Do... or do not. There is no try." - Yoda

Opinions expressed are property of my evil twin, not my employer.