Subject: Re: Q: Is authenticated denial needed ??

From: Masataka Ohta <[email-masked]>
Date: Thu, 1 Mar 2001 18:36:16 +0859 ()

Olafur;

> > If we were mistaken to put effort into implementing RFC2535, it
> > would have been a rather costly mistake, as some man-years of work
> > have been wasted then.
> 
> IF that is the conclusion it is better to come to that conclusion now than
> 3-5 years down the road when 10x-100x more man years have been wasted in 
> operating DNSSEC.

The best is to have had come to that conclusion 5 years up the road.

> > 
> > So again my question:
> > 
> >   Is there consensus to abort the implementation of RFC2535
> >   and wait for a rewrite to defined?
> > 
> 
> The question on the table is about one aspect of DNSSEC the authenticated
> denial, it is the most costly part of the specification and the one with
> least benefit. The question is it worth the cost, and if so we better
> document why. 

As I documented 5 years ago in  <draft-ohta-simple-dns-02.txt> ("Simple
Secure DNS"):
                           
         6. To authenticate other data types, use authenticated RRD. If
            the query for RRD returns wildcard, it should also be
            confirmed that there is no nodes exists to make the wildcard
            matching impossible.  For example, if "a.b.c.d." matches
            "*.c.d." it should be confirmed that nodes "a.b.c.d." nor
            "b.c.d." does not exit but a wild card "*.c.d." exists. ZL
            which exists in the additional section should give the
            required authentication for non-existent nodes.

it is necessary, because, otherwise, authenticated but false answer
may be wild card ones, even though exact match exists.

It does worth the cost of implementing secure DNS with authencated
denial. It took 2 weeks for me to modify BIND to mostly satisfy
extensions in <draft-ohta-simple-dns-02.txt>.

However, it does not worth the cost of implementing RFC2535,
I'm afraid.

PV> NO looks different but not necessarily better.  The only people I'd trust to
PV> give an answer are actual engineers and engineering managers who have
PV> implemented NXT (operably but not nec'ily interoperabily) and read the draft
PV> for NO.  If those conditions can't be satisfied, then we're just shooting into
PV> the darkness with this whole discussion.

Paul, the only people you should trust to give an answer are actual
engineers and engineering managers who instantly perceive difficulties
of NXT (or RFC2525 as a whole), never bother to implement it, write
an alternative draft and implement it.

							Masataka Ohta

to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.