Subject: NGtrans - DNSext joint meeting, call for participation

From: Alain Durand <[email-masked]>
Date: Fri, 20 Jul 2001 05:43:07 -0700

The NGtrans/DNSext chairs would like to make a call for participation
in the upcoming joint meeting.

The goal of the meeting is to facilitate consensus on how IPv6
addresses are represented in DNS and related issues. This meeting
requires extensive homework by participants and the chairs would like
to request submission of documents for a reading list for this meeting.

The output from the meeting will be draft consensus proposal.

Here is non exclusive a list of relevant topics:

1 - Design tradeoffs in DNS and IPv6 (AAAA, A6, DNAME, bit string)
       - DNS operational considerations including DNSSEC
         costs in regard of address record format
       - DNS implementation complications due to address record format
       - IPv6 Remembering requirements and impact on address record
         format
       - Case for A6
       - Case for AAAA
       - transition from ip6.int to ip6.arpa
       - transition from AAAA to A6

2 - tools/protocols/strategies to bridge IPv6 and IPv4 DNS resolution

Anybody wishing to make a presentation should send a draft
to the chairs of this meeting before July 26th 2001, 21:00 UTC
(that is, 2pm PDT, 5pm EDT, 11pm MEST)
     - Alain Durand <[email-masked]>
     - Olafur Gudmundsson <[email-masked]>

Drafts not yet published by the ID editor are acceptable
contributions (please include an URL).

The chairs will review the list of submission, derived the actual
agenda of the meeting from it and send all reading materials to the
DNSext and NGtrans mailing list no later than July 27th, 21:00 UTC.

	- Alain & Olafur.

to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.

---

From: Matt Crawford <[email-masked]>
Date: Mon, 23 Jul 2001 14:02:15 -0700

> ...

I offer

http://home.fnal.gov/~crawdad/draft-ietf-dnsext-ipv6-dns-response-00.txt

				Matt Crawford

---

From: [email-masked] (Andreas Gustafsson)
Date: Wed, 25 Jul 2001 05:57:23 -0700

I would like to comment on section 1.3:

>     1.3.  DNSSEC - Aggravation or Amelioration?
> 
>     An extreme case of A6 deployment (some might say a nightmare case),
>     in the A6 record for each portion of an address is in a zone
>     belonging to the party by whom that set of bits has been assigned.
>     This is a situation which is improved by ubiquitous use of DNSSEC
>     [DNSSEC] since the leaf site can cache authenticated data for its
>     entire prefix chain and a DNS client can confidently accept that
>     data without having to make extra queries.

You seem to be suggesting that if or when DNSSEC is deployed,
authoritative servers should start actively caching data related to
the data they are authoritative for, and resolvers (aka caching
servers) should start making use of response data outside the domain
for which the authoritative server is being queried, rather than
discarding it like current resolvers do.

I disagree.  Having authoritative servers send such cached data, and
having resolvers accept it, is a bad idea whether or not DNSSEC is
being used.  If a DNSSEC aware resolver accepts data from a poisoned
cache, DNSSEC will detect the poisoning, but this does not in any way
guarantee that the resolution will succeed - in practice, a much more
likely outcome is that a security error is returned to the client.
This could be exploited for denial of service attacks.
-- 
Andreas Gustafsson, [email-masked]