Subject: Adding an error code field to SIG(0)

From: "Scott Rose" <[email-masked]>
Date: Tue, 12 Aug 2003 09:37:54 -0400

As a follow up to the new SIG(0) revision, I talked about adding an error
code field or having the server return an error result in an reply with an
OPT message.  If the first solution is agreed upon, it would be the first 16
bits of the "original TTL" field in the SIG RR.  Since there is no TTL field
needed for meta-RRs, this could now be 16 bits for the error code, and 16
reserved bits.

The first draft of the error handling text is below.  This is not in the
first draft (draft-srose-rfc2931bis-00.txt)

5. Error Responses

If the attempted validation of a SIG(0) results in an error
condition, the host (DNS server or client) SHOULD send an error
message back to the message sender. The response message consists of
the following elements:

    A DNS message error code if applicable.

    The original question section.

    Empty answer and authority section.

Additional section consisting of a properly constructed SIG(0) RR
with the extended error code, but without an accompanying
signature. That is, missing the final field in the RDATA.
The SIG(0) returned in the error response does not contain a
signature to avoid a denial of service attack based on tying up
server resources valid cryptographic operations. The error code
returned in the SIG(0) RDATA depends on the type of error encountered
during validation.

If the server gets a message from a client that is not authorized to
make requests, the servers MUST reply with a REFUSED RCODE in the
response header and NOERROR in the SIG(0) error code field. The
server is not required to check the validity of the SIG(0) and MAY
reject the request outright.

If the client is allowed to make the request, but the validator
cannot obtain the public key needed to validate the SIG(0), the
server MUST send back a DNS message with ServFail RCODE in the
message header and BADKEY error code in the SIG(0) RR in the
additional section.

If the request fails to validate because of a timing error (that is,
the current server time falls out of the range given by the inception
and expiration times), the server MUST return a DNS response with
ServFail in the response code and BADTIME in the error code in the
SIG(0) RDATA. The time values in the response SIG(0) can be used by
the client to judge clock skew.

If the signature fails to validate for some other reason, the server
MUST send a response with the ServFail response code in the message
header, and a BADSIG error code in the SIG(0) RDATA.

---------------------------

comments desired/welcomed

Scott

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>