Subject: Re: Philosophy behind unsigned NS records?

From: Edward Lewis <[email-masked]>
Date: Wed, 9 Jun 2004 14:20:10 -0400

(Earlier I sent this privately to Ben because my "radio" was turned off.)

At 12:08 +0100 6/9/04, Ben Laurie wrote:
>Contemplation of issues related to NSEC2 has made me wonder why NS records are
>not signed at the delegation point.
>
>I realise that they are not authoritative at that point, but it seems to me
>that there's a (small) win gained in the case where the nameservers are in a
>signed zone but the zone being delegated is not signed (which is probably
>quite a common scenario in the early days of DNSSEC). Did I miss something?

RFC 2065-era assumption: only authoritative data is signed.

1) The fact that an NS exists is something established at the parent. 
What's in the RDATA is established by the child.  So we have a split 
authority problem.

2) DNS does not require, so far as I know, perfect coherence between 
the child's version of the NS set and the parent's version.  Relaxed 
coherence allows for "operational bumps."  Being able to tolerate 
that is what fuels DNS's incredible ability to scale.  (Systems that 
are too tight generally are too rigid and don't survive jolts.)

The "weakness" of the NS set in the eyes of security is a great asset 
in the eyes of scaling.  It's ironic, I know.
-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                            +1-703-227-9854
ARIN Research Engineer

Even the voices inside my head are refusing to talk to me anymore.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>