Subject: DNSSECbis Q-14: Security-aware recursive name server and response synthesis: SHOULD NOT or MUST NOT

From: Matt Larson <[email-masked]>
Date: Fri, 1 Aug 2003 15:24:47 -0400

This question corresponds to editor's note #13 from
draft-ietf-dnsext-dnssec-protocol-01.
 
Q-14: Under certain circumstances, a security-aware recursive name
servers could conceivably synthesize a response to one request using
security data in its cache from a different, previous request.  This
behavior is currently discouraged with SHOULD NOTs, but should it be
prohibited with MUST NOTs instead?

Background: Here is the text in question from Section 4.1 (page 23) of
draft-ietf-dnsext-dnssec-protocol-01:
 
   A security-aware recursive name server SHOULD NOT attempt to answer a
   query by piecing together cached data it received in response to
   previous queries that requested different QNAMEs, QTYPEs, or
   QCLASSes.  A security-aware recursive name server SHOULD NOT use NXT
   RRs from one negative response to synthesize a response for a
   different query.  A security-aware recursive name server SHOULD NOT
   use a previous wildcard expansion to generate a response to a
   different query.

      Editors' note: Should any of the SHOULD NOTs in this paragraph be
      MUST NOTs instead?

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>