Subject: I-D ACTION:draft-ietf-dnsext-dnssec-opt-in-00.txt

From: "Scott Rose" <[email-masked]>
Date: Tue, 03 Jul 2001 13:29:50 -0700

----- Original Message -----
From: "Scott Rose" <[email-masked]>
To: "Roy Arends" <[email-masked]>
Sent: Tuesday, July 03, 2001 4:23 PM
Subject: Re: I-D ACTION:draft-ietf-dnsext-dnssec-opt-in-00.txt

> > On Tue, 3 Jul 2001, Olafur Gudmundsson wrote:
> >
> > > At 10:08 AM 7/2/2001, Roy Arends wrote:
> > > >On Fri, 29 Jun 2001, Roy Arends wrote:
> > > >
> > > >In my opinion, it should be the NXT record itself rather than the KEY
> > > >record to indicate how it should be interpreted.
> > > >
> > > >About the zero bit:
> > > >
> > > >rfc2535, section 5.2 mentions the zero bit.
> > > >
> > > >         The first bit represents RR type zero (an illegal type which
> > > >         can not be present) and so will be zero in this format.
This
> format
> > > >         is not used if there exists an RR with a type number greater
> than
> > > >         127.  If the zero bit of the type bit map is a one, it
> indicates that
> > > >         a different format is being used which will always be the
case
> if a
> > > >         type number greater than 127 is present.
> > > >
> > > >As stated, if the type bit zero is a one, it indicates a different
> format.
> > > >The different format in this case is the opt-in format.
> > >
> > > This bit is off limits to any use but to extend NXT to types with code
>
> 127.
> > > If you want to use a bit in NXT to define Opt-in there are few type
> codes
> > > that I can pull out of the hat to do that from the low number bits
> (SINK,
> > > MB, etc.) or we just reserve a new type code for this.
> >
> > Perfect. We could even use a bit >127 then.
> >

 If the group decides to use a bit to determine the opt-in status (I haven't
decided if I like the idea or not - right now I'm leaning towards "not" but
don't have a better solution yet) - let's pick an unused number to avoid any
potential messy bugs with oddball zonefiles that may use exotic RR types
(like LOC, RP, etc).

 Just to be safe, and there are numbers to spare.

 Scott

to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.

---

From: Miek Gieben <[email-masked]>
Date: Wed, 04 Jul 2001 10:09:58 -0700

[On 04 Jul, 2001, Roy Arends wrote in " Re: I-D ACTION:draft-ietf-dnsext-dnssec-opt-in-00.txt "]
> > which zones are going to use opt-in? .com and .net? Can't we just say
> > that we will never do DNSSEC on .com/.net and friends. If you want to
> > be secure get your secure domainname under .secure?

<SNIP>

> In general, using optin relieves large TLD's for signing each and every
> individual Resource Record and creating (null/real)keys + sig + nxt + sig
> over unsigned delegations.
> 
> Going through the ICANN process and obtaining the .secure TLD seems very
> heavy. And next to that, the .secure TLD registry probably wants opt-in
> too.
why should a small TLD like .secure (going through ICANN is another 
story) would use opt-in? They can use dnssec right as it stands now.
The .secure will grow in time but I don't think it will ever reach
the size of .com.

I know what opt-in is trying to do, but i'm wondering if it isn't
an overkill for zones that are already too large for normal DNS

grtz Miek
NLet Labs

---

From: Mats Dufberg <[email-masked]>
Date: Wed, 04 Jul 2001 16:49:51 -0700

On Tue, 3 Jul 2001, Roy Arends wrote:

> There is no NXT/NO problem that has to be solved by SEC. Both RR types can
> be in a zone, the server serves it, the resolver interprets it. I don't
> see why a SEC record should indicate that there are NO records in a zone
> or NXT records in zone. The response clearly has either NXT or NO in its
> response.
>
> (The only reason for a SEC record I can think of is to indicate that there
> are neither NO nor NXT records. That would obsolete opt-in all together)
>
> Note that this is not a "what to expect" thing. If the parent states that
> a child is signed, the resolver expects either NXT or NO. (NO RR is still
> draft ofcourse).
>
> It is a chicken or egg thing. If there exists no SEC RR for the child,
> it gets either NXT or NO.

If a signed zone without neither NXT nor NO is to be permitted, then that
could be signaled by one NXT record, at the apex, with an RDATA not
possible in the normal use of NXT.

Mats

-----------------------------------------------------------------
Mats Dufberg                                     +46-8-545 857 06
[email-masked]                           fax: +46-8-545 857 29