Subject: Re: [dnsext] draft-ietf-dnsext-dnssec-bis-updates-10 Caching BAD Data

From: "Jeffrey A. Williams" <[email-masked]>
Date: Wed, 9 Jun 2010 13:36:36 -0500 (GMT-05:00)

Andrew and all,

  Good point.  But doesn't all this really revolve around
or more accurately 'Depend' on the trusting of the 
'covering trust anchor'?  Seems to me it does.  Please
advise.  If my assumption here is correct, than what
is or are the mechnisims for ensuring that the relevent
'covering trust anchor' is indeed 'trustworthy'?

-----Original Message-----
>From: Andrew Sullivan <[email-masked]>
>Sent: Jun 9, 2010 1:28 PM
>To: [email-masked]
>Subject: Re: [dnsext] draft-ietf-dnsext-dnssec-bis-updates-10 Caching BAD	Data
>
>Dear colleagues,
>
>On Tue, Jun 08, 2010 at 06:22:23PM -0400, Michael StJohns wrote:
>
>> Actually it does.  It may not say it clearly enough, but that's what
>> was meant. And if you read all three paragraphs of the text, it
>> really does say that.
>
>So since we're in agreement that we need text here, and since at least
>one person (me) doesn't understand your proposed text without
>re-reading it four or five times, I think we need different text.
>Let's try again.  I'm going to be verbose to start with, and then
>maybe we can whittle down if we can all agree.
>
>    A security-aware recursive name server might receive queries either
>    with CD=1 or with CD=0.  In addition, it might have cached data that
>    is the result of a query made with CD=1 or CD=0.
>
>    A general rule is that each cache entry MUST include some
>    indication of whether it came from a query performed with CD=1 or
>    with CD=0, or else that all cache entries MUST be treated as
>    though they were performed with CD=0.  This rule prevents data
>    that does not validate, but that may be cached to respond to CD=1
>    queries, from being returned in response to a query with CD=0.
>
>    When returning data for a query with CD=1, a validating
>    intermediate resolver MAY return data without validating.  It MUST
>    NOT return data without validating to a query with CD=0.  This
>    applies both to data that is available from cache, and to data
>    that must first be fetched before returning it.
>
>    A validating resolver MAY cache unvalidated data, and even data
>    that cannot be validated due to lack of a covering trust anchor,
>    in order to respond to queries with CD=1.  Such cached data MUST
>    NOT be used to respond to queries with CD=0.  If the validating
>    resolver subsequently validates that cached data, then it MAY use
>    it to respond to queries with CD=0.
>
>    If a validating resolver has a cached response of RCODE=2 (server
>    failure), and then receives a query with CD=1 to its name server
>    side, then it SHOULD [Note 1] perform the query again with CD=1
>    from its resolver side.  The result of that query is returned to
>    the query received on the name server side.  If the resolver is
>    able to validate the answer, then it MAY replace the cached
>    RCODE=2 response.  Otherwise, it MUST either leave the existing
>    cached response alone, or cache both responses along with an
>    indicator of the CD bit setting that engendered them.
>
>* Note 1: 4035 section 3.2.2 uses SHOULD for responding with all the
>data to CD=1, so I am pretty sure anything stronger than SHOULD would
>be a protocol change.
>
>I think that covers everything we have discussed on this topic.  I'm
>not at all sure that this sets all the rules according to the way
>people currently want them to be set, but at least it's broken into
>one paragraph per case so that we can change specifically the text
>there.  So have at it, please.  More participants would be good.
>
>Thanks,
>
>A
>
>-- 
>Andrew Sullivan
>[email-masked]
>Shinkuro, Inc.
>

Regards,

Jeffrey A. Williams
Spokesman for INEGroup LLA. - (Over 300+k members/stakeholders and growing, strong!)
"Obedience of the law is the greatest freedom" -
   Abraham Lincoln

"Credit should go with the performance of duty and not with what is very
often the accident of glory" - Theodore Roosevelt

"If the probability be called P; the injury, L; and the burden, B; liability
depends upon whether B is less than L multiplied by
P: i.e., whether B is less than PL."
United States v. Carroll Towing  (159 F.2d 169 [2d Cir. 1947]
===============================================================
Updated 1/26/04
CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of
Information Network Eng.  INEG. INC.
ABA member in good standing member ID 01257402 E-Mail [email-masked]
Phone: 214-244-4827

---

From: Andrew Sullivan <[email-masked]>
Date: Wed, 9 Jun 2010 14:51:06 -0400

> 'covering trust anchor' is indeed 'trustworthy'?

That is completely irrelevant to this discussion.  The DNSSEC
documents already note that obtaining a trust anchor is
out-of-protocol.

A

-- 
Andrew Sullivan
[email-masked]
Shinkuro, Inc.