Subject: QST: opt-in draft and resolver behaviour

From: Olaf Kolkman <[email-masked]>
Date: Fri, 30 Mar 2001 12:02:35 +0200

ref: draft-kosters-dnsext-opt-in-01.txt

Hi Mark,

I've been reading your draft a few times and I think I got the gist of
it. Still a few questions come to mind, they are mostly focused around
authenticated denial of zones.

Let's first focus on a world in transition to resolvers being
RETRY-NO-SEC-AWARE compliant;

In the 2nd example one queries for 5 RR type A with the DO bit set
only. It is clear that you follow the 2nd of the two lines of possible
server responses and the server searches the non-secure view. The
answer is:

   RCODE=NOERROR
    Answer Section:
       5 NS
    Authority Section:
       3 NXT (6), SIG NXT
    Aditional Section
       KEY, SIG KEY

I can't really find in the RFCs what a security aware resolver should
do with the answer, but based on the data in the authority section I'd
say that the resolver should interpret the answer as '5 RR NS does not
exist', but then again the server is authoritative (?) for this
answer...

In the case a resolvers is RETRY-NO-SEC-AWARE compliant it will go
back and try the non-secure tree. But that opens the possibility for a
a spoof and there is no way I can authenticate denial of a domain.

My interpretation is that in the context of your draft NXT indicates
which children are secured and not which labels exist. In other words
authenicated denial will be broken.

--Olaf 

-----------------------------------------------------
  Olaf M. Kolkman      |  RIPE NCC 
     -----------       |      ---------------	   
  RIPE NCC             |  Phone:   +31 20 535 4444
  Singel 258           |  Fax:     +31 20 535 4445
  1016 AB Amsterdam    |  http://www.ripe.net
  The Netherlands      |  [email-masked]       

to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.