Subject: issue with draft-ietf-dnsext-dnssec-trans-00.txt section 2.2.3

From: David Blacka <[email-masked]>
Date: Wed, 16 Jun 2004 13:03:10 -0400

I apologize for not bringing this up earlier.  Or, perhaps, for bringing it up 
at all ;-)

I do not think the language in section 2.2.3.2 is entirely correct:

   Validating resolvers agnostic of new interpretation will treat the
   NSEC RRset as "not signed". This affects wildcard and non-existence
   proof, as well as proof for (un)secured delegations. Also, all
   positive signatures (RRSIGs on RRSets other than DS, NSEC) appear
   insecure/bogus to an old validator.

Specifically, the second sentence.  If the validator is considering the zone 
unsigned (i.e., Insecure), how will anything in the zone appear to be 
"bogus"?  This language appears to contradict the language in the intro to 
this section (2.2.3).

I will also note that I think I've tested this behavior with the only 
implementation I had at the time: a bind 9.3 snapshot, and, as far as I could 
tell, it worked as expected.  That is, everything resolved and appeared to be 
insecure.

   The algorithm version space is split for each future version of
   DNSSEC. Violation of the 'modular components' concept. We use the
   'validator' to protect the 'resolver' from unknown interpretations.

The first sentence of this paragraph appears to be true, but the second 
sentence doesn't make much sense to me.  a) I don't know what the 'modular 
components' concept is, exactly, and b) if I were to guess what it meant, I 
would still think that this was wrong: the whole exercise here is confined to 
the 'validator' function, AFAICT.

-- 
David Blacka    <[email-masked]> 
Sr. Engineer    VeriSign Applied Research

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Roy Arends <[email-masked]>
Date: Wed, 16 Jun 2004 20:09:16 +0200 (CEST)

> "bogus"?  This language appears to contradict the language in the intro to

Yep, we'll delete bogus.

> the 'validator' function, AFAICT.

Modular concept as in validator/resolver/server/cache. What I ment to say
here is that the unknown algorithm is used as signal to a validator that
now the resolver should not use interpretation class 'NSEC' but
interpretation class 'NSEC-Alt'. But, I guess the discussion of where that
functionality belongs is academic. Remember from the -intro doc that a
validator and a resolver might not be single component, hence modular.

It is still a hack though, it uses a field which purpose is to indicate a
specific signature algorithm as a signal for NSEC interpretation.

Bogus is gone in -01 and I'll try to ameliorate language on 'modular
concept'.

Thanks,

Roy