Subject: Re: Opt-in wg last call

From: Roy Arends <[email-masked]>
Date: Tue, 9 Apr 2002 19:19:46 +0200 (CEST)

On Mon, 8 Apr 2002, Edward Lewis wrote:

> At 6:46 PM -0400 4/5/02, Daniel Massey wrote:
> >is there a compelling reason to allow a SIG without a NXT?
> >I don't see one...
>
> Immaterial SIG resource records are (or were) a reason to allow SIGs to
> exist without NXT.  There was a time when there was a desire to allow an
> application to sign data, stick that SIG in DNS, and then have the
> application's other end validate the data.  How the validating key was
> distributed was not defined and might not have involved the KEY RR (hence
> restricting KEY RR may not obviate this scenario).
>
> As far as "compelling reason to allow" - there isn't any harm in a SIG
> without NXT to the DNS protocol, so I wouldn't go about restricting it in
> the specifications.

There is a compelling reason. If I explicitly sign a record, which does
not require to have a NXT associated with it, some malicious entity can
falsly prove I don't exist (2535 NXT), or am not signed (opt-in NXT).
Therefor:

 1) NXT chain covers ALL signed names in a zone.
 2) ALL signed names have a NXT record associated with it.

Roy

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Roy Arends <[email-masked]>
Date: Tue, 9 Apr 2002 19:19:46 +0200 (CEST)

Roy