Subject: dnssec-protocol ISSUE: permit DNSKEY's at all owner names

From: Simon Josefsson <[email-masked]>
Date: Tue, 22 Jun 2004 11:10:15 +0200

DNSKEY's are forbidden at delegation points, for unclear reasons.

name: Simon Josefsson
email: [email-masked]
Date: 22 June 2004
Reference: http://ops.ietf.org/lists/namedroppers/namedroppers.2004/msg01150.html
Type: T
Priority: W

Document: draft-ietf-dnsext-dnssec-protocol-06
Section: 2.1

Rationale/Explanation of issue:

DNSKEY's are disallowed at delegation points in DNSSEC-bis:

   DNSKEY RRs MUST NOT appear at delegation points.

I propose to remove this requirement, as I haven't seen a technical
motivation for it.  If there indeed is a technical motivation, I think
it should be stated in connection with the requirement.

See the URL above for more discussion.

This issue was resolved, I believe, the way I proposed, when this was
discussed for the KEY record.  It appears as if the decision was
reverted in DNSSEC-bis.  See:

http://ops.ietf.org/lists/namedroppers/namedroppers.2004/msg01158.html

Requested change:

Drop sentence from section 2.1:

  DNSKEY RRs MUST NOT appear at delegation points.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Olaf Kolkman <[email-masked]>
Date: Tue, 22 Jun 2004 11:28:12 +0200

Issue is created in the issue tracker. As issue 6
  see https://roundup.machshav.com/dnsext/

Please reply in thread.

--Olaf

---

From: "Olaf M. Kolkman" <[email-masked]>
Date: Thu, 24 Jun 2004 11:08:30 +0200

>   DNSKEY RRs MUST NOT appear at delegation points.

This seems to be in the spirit of the Q-8 and Q-11.

I would replace the above sentence with something like:

   DNSKEY RRs appearing above the delegation point are non-authoritative.

Maybe even make it explicit that the above means that one is dealing
with glue and the DNSKEY RRs should not be signed by the parent.

-- Olaf
   No hats.

---------------------------------| Olaf M. Kolkman
---------------------------------| RIPE NCC

---

From: "Scott Rose" <[email-masked]>
Date: Thu, 24 Jun 2004 10:10:36 -0400

> -----Original Message-----
> From: [email-masked]
> [mailto:[email-masked]]On Behalf Of Olaf M. Kolkman
>
>

I like that text added in addition to dropping the "MUST NOT" language in
Section 2.1  I don't see anything wrong in text reminding that glue is
non-authoritative - especially when it deals with DNSSEC stuff like keys.

Put it this way:  Does anyone not want this text added in addition to
dropping the "MUST NOT"?

Scott

---

From: Mike StJohns <[email-masked]>
Date: Thu, 24 Jun 2004 10:23:01 -0400

>    DNSKEY RRs appearing above the delegation point are non-authoritative.

DNSKEY RRs appearing above the delegation points are non-authoritative, 
extraneous and MUST NOT be used to determine the validity of any DNSSEC 
trust chain.

---

From: Mike StJohns <[email-masked]>
Date: Thu, 24 Jun 2004 10:26:58 -0400

Sorry - should have also said:

This needs to be in the form of what the resolver does when it sees weird 
things, rather than a prohibition on the server putting the things 
there.  While its true the parent should sign these, from time to time 
someone will and we need to be clear on what the behavior of the resolver 
needs to be.

---

From: Olaf Kolkman <[email-masked]>
Date: Thu, 24 Jun 2004 17:01:18 +0200

Hi Mike,

On Jun 24, 2004, at 4:26 PM, Mike StJohns wrote:

> This needs to be in the form of what the resolver does when it sees 
> weird things, rather than a prohibition on the server putting the 
> things there.  While its true the parent should sign these, from time 
> to time someone will and we need to be clear on what the behavior of 
> the resolver needs to be.
>

I am loosing you with "While it is true the parent should sign 
these"... The parent is not authoritative for glue record, these DNSKEY 
RRs are not to be signed by the parent.

> DNSKEY RRs appearing above the delegation points are 
> non-authoritative, extraneous and MUST NOT be used to determine the 
> validity of any DNSSEC trust chain.
>

I do agree with your language though.

(I was about to argue that the MUST NOT should be a SHOULD NOT but I 
refrain because a allowing for  'glue' DNSKEY and RRSIGs both with the 
childs owner name but added as glue by the parent is probably a bad 
idea)

--Olaf

---

From: "Scott Rose" <[email-masked]>
Date: Thu, 24 Jun 2004 11:06:32 -0400

> [mailto:[email-masked]]On Behalf Of Mike StJohns
> Sent: Thursday, June 24, 2004 10:27 AM

How about adding text:

DNSKEY RRs appearing above the delegation point are non-authoritative cannot
be used for
validation of RRSIGs by validators unless the DNSKEY RRs also meet the
requirments in Section 5.

- or change the "cannot" to SHOULD NOT/MUST NOT to make it more forceful?

Scott

---

From: Mike StJohns <[email-masked]>
Date: Thu, 24 Jun 2004 11:24:29 -0400

At 11:01 AM 6/24/2004, Olaf Kolkman wrote:

>I am loosing you with "While it is true the parent should sign these"... 
>The parent is not authoritative for glue record, these DNSKEY RRs are not 
>to be signed by the parent.

Typo:  "While it is true the parent SHOULDN'T sign these" from time to time 
someone is going to do it by mistake or for other weird purposes.

>childs owner name but added as glue by the parent is probably a bad idea)

MUST NOT is correct.  This is not a matter of implementation guidance, but 
of proper functioning.  A DS based DNSSEC implementation can't properly 
deal with a DNSKEY record of the same name occurring above and below a 
delegation point.  The one above the delegation point (e.g. in the parent) 
is extraneous and must be ignored.

---

From: Paul Vixie <[email-masked]>
Date: Thu, 24 Jun 2004 16:41:34 +0000

> How about adding text:

i'm uncomfortable with this case-by-case discussion of rrtypes above a
delegation point.  the way the base dns protocol works is that "an NS
RRset at a zone bottom is (a) nonauthoritative and (b) cannot be
usefully accompanied by any other data."  the way rfc2535 changed this
is hard to describe, and now irrelevant.  the way dnssec-bis changed
this is to add two words "except NSEC and DS" to (b) above.

we do not need to mention that DNSKEY shouldn't appear "above the cut",
and if we do then some future reader of the document might incorrectly
infer that since we said this about DNSKEY but didn't say it about A or
TXT or MX, that "the intent of the framers" is that all rrtypes not
described as ``can't appear above the cut'' must in fact be able to
appear above the cut."  that is NOT our intent, so let's not imply it!

can we just explain that

    While DNSSEC-BIS specifies the placement of two new RRsets, NSEC and DS,
    in the parent zone above zone cuts, this is an exception to the general
    prohibition against putting data in the parent zone above a zone cut, and
    the general prohibition remains in effect.  See RFC 1034.

and not go into this on an rrtype-by-rrtype basis?

re:

> DNSKEY RRs appearing above the delegation point are non-authoritative
> cannot be used for validation of RRSIGs by validators unless the
> DNSKEY RRs also meet the requirments in Section 5.
>