Subject: Re: NSEC version field (Re: NSEC2- and an Authenticated Denial M echanism Flag)

From: Paul Vixie <[email-masked]>
Date: Tue, 01 Jun 2004 14:34:25 +0000

> ..., but I'm not optimistic that we can find a "future amendment"
> means.  I'm often wrong.  I mean, from the thinking I've done, I
> really don't see a way to introduce versioning to the DNS protocol.

it's a second dnssec-wanted flag in edns0.  (dnssec-bis already depends
on edns so this is not a big change.)  the bit means "when i said i wanted
dnssec responses, i really meant i could handle dnssec-ter if you've got it.)

> I haven't proven (even to myself) that it can't be done.  From all the
> angles I've looked and with all of my assumptions applied it looks bleak
> though.
> 
> The only versioning precedent we have is EDNS(0) - and that only works
> because an "advanced" protocol speaker falls back to the old ways to a
> "legacy" protocol speaker.  I don't see this strategy working between
> NSEC and obfuscated authenticated denial.

if NSEC2 has a new type code (and maybe RRSIG but probably not DNSKEY) and
if we promote "want dnssec-ter" as from hop-by-hop to end-to-end (by only
returning cached data if it was acquired using the same flags as the current
query) then this is all pretty simple.

the harder problem is how to keep a bazillion other features out so that -ter
can deploy in a short year or two rather than a whole decade.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Paul Vixie <[email-masked]>
Date: Mon, 14 Jun 2004 21:31:43 +0000

> I like the second possible answer.  The first answer is "special case" and
> I loathe those.  The second answer is based on a concept in use elsewhere
> (serial number arithmetic, signature lifetimes).

one additional thing to note is that in my example, @ and X have different
numbers of labels, since X would be a subdomain of @.  therefore, "wrapping"
could mean "all domain names ending in the shared owner/target name, including
that name" and probably does.  but where does it say that in the -bis docset?

---

From: Paul Vixie <[email-masked]>
Date: Thu, 17 Jun 2004 19:18:52 +0000

> It's "what if there's a DNSSECbis key for the root" or some other top zone?
> 
> Maybe - what if we discourage a key from being distributed (operationally)
> for the root until we get to Draft Standard?

semantically, that boils down to "dnssec-bis is not dnssec, use it for
small experiments only, we'll have -ter for you in a year or two."

let's be very careful about actually making statements equivalent to that.
(the above is only a proposal, not a statement, so we're ok so far... but
the day is young.)

((herding cats would be easier.  this is like trying to get a bunch of
puppies into a bag, without a twist-tie and without rocks.))