Subject: RE: the DNS/DNSSEC KEY RR debate

From: "Loomis, Rip" <[email-masked]>
Date: Sun, 4 Aug 2002 23:52:00 -0400

At 8:13 PM (by someone's clock) on 8/4/2002, someone vaguely
claiming to be Rob Austein wrote:
> At Sun, 04 Aug 2002 12:53:03 -0400, Michael Richardson wrote:
> >   Rob> There is a specific problem with using the KEY RR
> >   Rob> type for things other than DNSSEC's own internal
> >   Rob> keying.   It's called the "sub-typing problem"
> >
> >   Yes, and obsoleting KEY does nothing to solve this problem.
> Sorry, wrong.  (a) it removes the need for DNSSEC-aware resolvers
> to sift through RRsets picking out individual keys by subtype
> codes, and (b) it reduces the chances that KEY RRsets will be
> large enough to trigger DNS message truncation and fallback to
> TCP.

As a minor point of clarification, and please slap me with the
clue-by-four if I missed something, I believe that (b) is a
don't care.  Are we still considering that there's anyone out
there who intends to do DNSSEC and can't/won't support EDNS0 ???
If not, then I don't think that "fallback to TCP" is a strong
persuader...and perhaps it shouldn't be bruted about at all
for situations such as this.  "Fallback to TCP" might still
be a valid concern for other DNS enhancements/thingies, but from
everything I see it's a non-issue for DNSSEC-aware servers and
resolvers.

As I indicated, perhaps I missed something--please edu-ma-cate
me if I did and you have the time to edu-ma-cate me.  Otherwise,
I do agree with the points in your original e-mail.

  --Rip

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Rob Austein <[email-masked]>
Date: Mon, 05 Aug 2002 01:35:54 -0400

At Sun, 4 Aug 2002 23:52:00 -0400 , Rip Loomis wrote:
> 
> > ... (b) it reduces the chances that KEY RRsets will be

The large print giveth and the small print taketh away.

EDNS0 lets you use larger packets.  But we've also got SIG RRs, and DS
RRs, and KEYs sometimes show up via additional section processing, and
we're probably heading for about a decade of IPv4 => IPv6 transition,
which means dual stack, which means A and AAAA coexistance.

So yeah, EDNS0 helps, but I don't think EDNS0 means we can stop
worrying about message size completely.

---

From: [email-masked]
Date: Mon, 05 Aug 2002 16:35:27 +1000

> everything I see it's a non-issue for DNSSEC-aware servers and

	EDNS/UDP does not save you have *different* key sub-types
	at the same node.  It will get you to ~4k.
 
--
Mark Andrews, Internet Software Consortium
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]