Subject: RE: NSEC version field (Re: NSEC2- and an Authenticated Denial M echanism Flag)

From: Edward Lewis <[email-masked]>
Date: Tue, 1 Jun 2004 10:12:19 -0400

At 16:48 -0700 5/28/04, Hallam-Baker, Phillip wrote:
>The quickest way to arrive at a consensus that we do not have to
>change DNSSECbis is to convince the Europeans that deployment of
>DNSSECbis as it stands will not preclude a future ammendment to
>address an issue they consider a deployment showstopper.

Well, convincing not "Europeans" but those with privacy concerns...;)

Fine with me, but I'm not optimistic that we can find a "future 
amendment" means.  I'm often wrong.  I mean, from the thinking I've 
done, I really don't see a way to introduce versioning to the DNS 
protocol.

I haven't proven (even to myself) that it can't be done.  From all 
the angles I've looked and with all of my assumptions applied it 
looks bleak though.

The only versioning precedent we have is EDNS(0) - and that only 
works because an "advanced" protocol speaker falls back to the old 
ways to a "legacy" protocol speaker.  I don't see this strategy 
working between NSEC and obfuscated authenticated denial.

-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                            +1-703-227-9854
ARIN Research Engineer

Even the voices inside my head are refusing to talk to me anymore.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Paul Vixie <[email-masked]>
Date: Tue, 01 Jun 2004 14:34:25 +0000

> ..., but I'm not optimistic that we can find a "future amendment"
> means.  I'm often wrong.  I mean, from the thinking I've done, I
> really don't see a way to introduce versioning to the DNS protocol.

it's a second dnssec-wanted flag in edns0.  (dnssec-bis already depends
on edns so this is not a big change.)  the bit means "when i said i wanted
dnssec responses, i really meant i could handle dnssec-ter if you've got it.)

> I haven't proven (even to myself) that it can't be done.  From all the
> angles I've looked and with all of my assumptions applied it looks bleak
> though.
> 
> The only versioning precedent we have is EDNS(0) - and that only works
> because an "advanced" protocol speaker falls back to the old ways to a
> "legacy" protocol speaker.  I don't see this strategy working between
> NSEC and obfuscated authenticated denial.

if NSEC2 has a new type code (and maybe RRSIG but probably not DNSKEY) and
if we promote "want dnssec-ter" as from hop-by-hop to end-to-end (by only
returning cached data if it was acquired using the same flags as the current
query) then this is all pretty simple.

the harder problem is how to keep a bazillion other features out so that -ter
can deploy in a short year or two rather than a whole decade.

---

From: [email-masked]
Date: Tue, 1 Jun 2004 16:52:54 +0200 (CEST)

> query) then this is all pretty simple.

DS as well, to protect non NSEC2 capable resolvers being delegated
into a NSEC2 zone.

Roy

---

From: Paul Vixie <[email-masked]>
Date: Tue, 01 Jun 2004 16:54:07 +0000

> > if NSEC2 has a new type code (and maybe RRSIG but probably not
> > DNSKEY) and if we promote "want dnssec-ter" as from hop-by-hop to
> > end-to-end (by only returning cached data if it was acquired using
> > the same flags as the current query) then this is all pretty simple.
> 

for the purpose of proving that dnssec-bis can coexist with and ultimately
be replaced by dnssec-ter, only one RR has to be shown to be incompatible.

furthermore, dnssec-ter might very well use NO rather than NSEC, or opt-in,
or who knows what.  the point is, it won't be compatible with dnssec-bis,
and we have to show that there's a migration strategy that injures nobody.

i personally like NSEC2 and i wish that those ideas had been proposed at
the time when NO-vs-NXT was being discussed.  but that doesn't mean NSEC2
is the winner, or that it would be the only thing in -ter.  we need to show
that there is a way forward; we do not need to show where that way leads.