Subject: Re: rrsig(qtype)

From: Roy Arends <[email-masked]>
Date: Thu, 17 Jun 2004 21:40:06 +0200 (CEST)

On Thu, 17 Jun 2004, Paul Vixie wrote:

> i promised to speak separately about my larger concerns about this approach:
>
> > > > Okay, d'you think it is appropriate for -trans ?
> > >
> > > If -trans is suggesting real-time signatures for people who don't want
> > > NSEC, then yes I think it's appropriate for -trans.
> >
> > Yes. -trans is suggesting real-time signatures as a measure against
> > zone-traversal until dnssec-ter has arrived. For the rest, there is
> > dnssec-ter, or the DoNothing option.
>
> do you mean you intend to modify -bis to require that initiators be able
> to recognize this form of on-the-fly denial of existence if responders
> wish to avoid the precomputed-NSEC method?

Not entirely. If the change would be minimal (and it seems that is not the
case), I would recommend to change -bis. But if it would delay -bis for
more then the currently expected editorial/clarification delay it would
not be worth it.

> things that would require changes to the entire installed based in order
> to be effective belong in -bis rather than in -trans.

I agree.

> (and it doesn't even belong in -trans unless it also provides an way to
> encode authenticated nonexistence of <qname,qclass> not just <...,qtype>.)

rrsig(any).

> > > Does it require any changes to bis for proper resolver interpretation of
> > > this answer? (I believe the answer to this question is "no", but it's
> > > something that needs to be asked).
> >
> > Well, hmmm,  it is a response-type that dnssec-bis resolvers do not yet
> > swallow. I think the changes to -bis are minimal to allow this.
>
> i think you're wrong, and that the changes would have to go through
> considerable review, analysis, modelling, and testing before i'd feel
> comfortable approving them.

I understand your concern. I've been through all the response types
containing NSECs, and it is indeed not trivial, though much less complex,
since the denial is explicit instead of implicit. In any case, it is a
protocol change.

The whole rrsig(qtype) is imho a working concept as a defense against
zone-traversal, but it is too late for -bis and too early for -ter.

I won't stuff it in -trans and bring it up after -ter.

Roy

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>