Subject: Re: QST: opt-in draft and resolver behaviour

From: Edward Lewis <[email-masked]>
Date: Tue, 3 Apr 2001 13:00:08 -0400

At 6:02 AM -0400 3/30/01, Olaf Kolkman wrote:
>In the case a resolvers is RETRY-NO-SEC-AWARE compliant it will go
>back and try the non-secure tree. But that opens the possibility for a
>a spoof and there is no way I can authenticate denial of a domain.

Yes, but this (the possibility of a spoof) is no worse than where we are today.

>My interpretation is that in the context of your draft NXT indicates
>which children are secured and not which labels exist. In other words
>authenicated denial will be broken.

A name that does not exist in .com (are there some left?) needs no
protection.  So if first the authenticated denial arrives and the retry
that should yield an unauthenticated NXDOMAIN is spoofed out to say the
domain does exist, this is no different from today.

A name that is unsecured in .com is protected under this just as it is
today - the query in the secured view is just "spurious traffic" and
doesn't impact the outcome.

A name that is secured will be protected as if there is no unsecured .com -
in the eyes of a secured resolver.  (If the resolver is unsecured, we have
the same situation as today.)

Basically, Mark's draft offers a higher "QOS" for some names in his zone by
adding security.  The benefit to the community is that this will allow a
secured .com to appear sooner as the proposal lowers the start-up cost.

However, there is a danger in this proposal.  If the proposed set up is
transitional, this works, but what if this becomes the norm?  Will we have
.com, .com(-sec), .com(-v6), .com(-v6-sec)?  This would be a split-brain
DNS, something we really don't want.

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                                NAI Labs
Phone: +1 443-259-2352                      Email: [email-masked]

Dilbert is an optimist.

Opinions expressed are property of my evil twin, not my employer.

to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.

---

From: Mark Kosters <[email-masked]>
Date: Tue, 3 Apr 2001 19:05:52 -0400

> DNS, something we really don't want.

Your forgetting international dns.  Actually, EDNS0 coupled with the okbit 
draft actually have forged the tools to make this happen. I'm sure more will
follow.

Split-brain dns seems a bit harsh. IMHO, we are starting to see that 
dns needs a drastic overhaul to enforce single-brain dns technically.
However, today's DNS could mitigate the fracture with policy.

Mark

-- 

Mark Kosters             [email-masked]       Verisign Applied Research
PGP Key fingerprint =  1A 2A 92 F8 8E D3 47 F9  15 65 80 87 68 13 F6 48

---

From: Olaf Kolkman <[email-masked]>
Date: Wed, 04 Apr 2001 09:37:33 +0200

Mark, Ed, others,

> secured .com to appear sooner as the proposal lowers the start-up cost.

I can see the benefit of that...

I still wonder what a secured resolver that is not RETRY-NO-SEC-AWARE
(i.e. the tools we have today) should do with:

   RCODE=NOERROR
    Answer Section:
       5 NS
    Authority Section:
       3 NXT (6), SIG NXT
    Additional Section
       KEY, SIG KEY

I've tried to get the answer from 2535 but in section 5.4 the RFC only
addresses the case that the authority section is consistent with the
answer i.e. NXDOMAIN with appropriate NXT and SIG NXT.

I'm puzzled, what should a secure resolver believe, the possibly
spoofed, answer section or the signed authority section?  Depending on
the answer to that question a not RETRY-NO-SEC-AWARE resolver might
see major parts of .com.

--Olaf

-----------------------------------------------------
  Olaf M. Kolkman      |  RIPE NCC 
     -----------       |      ---------------	   
  RIPE NCC             |  Phone:   +31 20 535 4444
  Singel 258           |  Fax:     +31 20 535 4445
  1016 AB Amsterdam    |  http://www.ripe.net
  The Netherlands      |  [email-masked]

---

From: Mark Kosters <[email-masked]>
Date: Wed, 4 Apr 2001 13:41:54 -0400

> the answer to that question a not RETRY-NO-SEC-AWARE resolver might

Since 5 is not secure, it is no worse than it is today since spoofing
could happen at lower levels as well. The NXT and accompaying SIG assure the 
resolver that the answer could not be a spoofed delegation that was secure.

Mark

--