Subject: Re: rrsig(qtype)

From: Paul Vixie <[email-masked]>
Date: Thu, 17 Jun 2004 19:10:25 +0000

> Presented as said in my previous mail (empty answer, rrsig in auth), it
> can then be interpreted as an authenticated denial for QNAME,QTYPE,QCLASS.

but not for <qname,qclass> as in authenticated rcode=3?  would that become
possible if we used qtype=NULL or qtype=ANY as a special case?

(note that i'm very concerned about another aspect of this, but i want to
answer that part separately.)

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Paul Vixie <[email-masked]>
Date: Thu, 17 Jun 2004 19:15:15 +0000

i promised to speak separately about my larger concerns about this approach:

> > > Okay, d'you think it is appropriate for -trans ?
> >
> > If -trans is suggesting real-time signatures for people who don't want
> > NSEC, then yes I think it's appropriate for -trans.
> 
> Yes. -trans is suggesting real-time signatures as a measure against
> zone-traversal until dnssec-ter has arrived. For the rest, there is
> dnssec-ter, or the DoNothing option.

do you mean you intend to modify -bis to require that initiators be able
to recognize this form of on-the-fly denial of existence if responders
wish to avoid the precomputed-NSEC method?

things that would require changes to the entire installed based in order
to be effective belong in -bis rather than in -trans.

(and it doesn't even belong in -trans unless it also provides an way to
encode authenticated nonexistence of <qname,qclass> not just <...,qtype>.)

> > Does it require any changes to bis for proper resolver interpretation of
> > this answer? (I believe the answer to this question is "no", but it's
> > something that needs to be asked).
> 
> Well, hmmm,  it is a response-type that dnssec-bis resolvers do not yet
> swallow. I think the changes to -bis are minimal to allow this.

i think you're wrong, and that the changes would have to go through
considerable review, analysis, modelling, and testing before i'd feel
comfortable approving them.