Subject: Re: NSEC3 Issue 17: opt-out for delegation only is not enforcable.

From: David Blacka <[email-masked]>
Date: Tue, 6 Jun 2006 11:36:34 -0400

On May 31, 2006, at 7:11 AM, Roy Arends wrote:

> Issue:
>
> The use of Optout is restricted to unsigned delegations. This  
> restriction
> is inherited from the experimental Opt-In draft. Even-though the
> restriction is in place, it can't be enforced on the server side, i.e.
> there is a way to allow unsigned records other than delegations to  
> exist
> in an optout span, without it ever to appear as such on the wire,  
> by means
> of delegating them to unsigned subzones with the same name.
>
> Discussion:
>
> Assume the administrator of the secured zone 'example.com' wants  
> the world
> to see 'www.example.com' as unsigned. He could delegate  
> www.example.com
> away as an optout unsigned delegation to another server.
>
> This process can be automated without breaking any signatures.  
> Delegation
> point NS records are unsigned, and there is no evidence the NS record
> exist if the NSEC3 duo that proves the closest provable encloser is  
> marked
> as optout. This would violate the NSEC3 draft where a signer MUST NOT
> allow any other record than delegation point NS records to exist in an
> optout span.

I would say that the issue is more accurately described as an  
inability to enforce delegation-only on the validator side.  That is,  
it is impractical for a validator to be in the business of making  
absolutely certain that only delegations exist within opt-out spans.

However, I do not believe that this is really an issue either for  
NSEC3 or for the experimental opt-in draft.  Delegation-only is a  
MUST on the server (and thus signer) side because it forms an  
underlying assumption in how an opt-in/out aware validator  
validates.  That is, the validator is only required to pay attention  
to the flag in cases where a delegation could have been opted out.

That it may be possible to violate the "delegation-only" restriction  
on the server side without being detected by the validator is of no  
consequence because the same effect can always be achieved legally  
(by using a delegation).

--
David Blacka    <[email-masked]>
Sr. Engineer    VeriSign Applied Research

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>