Subject: Re: Philosophy behind unsigned NS records?

From: Ben Laurie <[email-masked]>
Date: Wed, 09 Jun 2004 16:04:33 +0100

Scott Rose wrote:
> Not sure what you mean here.  What would that gain us?  If I get it right, a
> delegation to an unsecure child would look like:
> 
> Answer section:
> 			blank
> Authority section:
>  sub.example.com		NS
> 				RRSIG (NS)
> Additional
>  ns.sub.example.com	A
>  hash__sub.example.com	NSEC2  bitmap w/o DS RR.
> 
> There still needs to be some information about the DS, or lack thereof.  I
> don't see what signing the NS set gains us with this.

It means that the delegation can't be spoofed. Note that the delegation 
could be to a nameserver in a signed domain, and so its A record could 
also not be spoofed.

Cheers,

Ben.

-- 
http://www.apache-ssl.org/ben.html       http://www.thebunker.net/

"There is no limit to what a man can do or how far he can go if he
doesn't mind who gets the credit." - Robert Woodruff

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Roy Arends <[email-masked]>
Date: Wed, 9 Jun 2004 17:38:07 +0200 (CEST)

> could be to a nameserver in a signed domain, and so its A record could

A security aware caching resolver would overwrite non-authoritative signed
data with authoritative unsigned data in this case. Delegation point NS
records (and optional glue address records) are authoritative elsewhere,
so they'd need to be signed elsewhere. The additional cost of delegation
point signatures are placed on the parent, while the gain is minimal.

Roy