Subject: Re: comments on ds-13

From: Olafur Gudmundsson <[email-masked]>
Date: Tue, 06 May 2003 11:56:16 -0400 (EDT)

On Wed, 12 Mar 2003, Paul Vixie wrote:

> > The robustness principal probably applies here.
>
> i'm sure it does but i think i interpret it in the opposite way.
>
> > DS is a DNS infrastructure RR type, we know of no useful purpose that
> > DS RRs anywhere other than at delegation points would serve, and at
> > least some of us think that reusing existing RR types for
> > fundamentally different purposes is a risky thing to do
>
> others of us think that putting in feel-good restrictions whose implementation
> status is unlikely to be rigourously tested (either for operability reasons or
> interoperability reasons) ultimately does no good (ever) and some harm (often).
>
> > ... therefore:
> >
> > a) Zones either SHOULD NOT or MUST NOT include DS RRs anywhere but at
> >    delegation points;
> >
> > b) Software MUST cope if a zone violates (a).
> >
> > I tend to think that (a) should be MUST NOT, on the grounds that it
> > probably simplifies the implementation of (b) slightly (software must
> > not fall on its face, full stop, but don't expect an implementation to
> > do anything useful with a non-delegation DS RR).
>
> i humbly disagree.  we should define what we mean and say that other uses are
> undefined.  if we some day think of a reason to use these at non-delegation
> points, it'll be wonderful to know that authority servers (both master and
> slave) and caching forwarders are willing to pass the data through even though
> they have reason to believe that it wasn't at a delegation point.

As you ask for a reason why I will not make the change.
I worry about allowing DS at non delegation will/may cause similar
harm as DNAME creating delegations that are only reachable via the
DNAME chain.

Thus the text in DS-14 will be unchanged.

	Olafur

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Paul Vixie <[email-masked]>
Date: Tue, 06 May 2003 17:00:27 +0000

> > ... disagree.  we should define what we mean and say that other uses
> > are undefined.  if we some day think of a reason to use these at
> > non-delegation points, it'll be wonderful to know that authority
> > servers (both master and slave) and caching forwarders are willing
> > to pass the data through even though they have reason to believe
> > that it wasn't at a delegation point.
> 

that's good news.  for the record, non-delegation DS RR's might be part
of an "islands of security" proposal i'm doodling.  i'm not sure how
realistic the "dnssec in 2003" plan is any more, but it may require that
authentication not follow delegation chains.  knowing that a DS RR that's
not at a delegation point won't be considered a protocol or data error
might be very helpful.