Subject: dnssec: super/subzone NULL keys

From: Roy Arends <[email-masked]>
Date: Thu, 6 Apr 2000 14:28:57 +0200 (CEST)

Hello,

When a null-key for a subzone appears in its superzone, while the subzone
itself has a key, the subzone key is more authoritative then the null key
in its parent. Is there any problem for this superzone to keep the null
key in its zone ?

The reason I ask this is when a large delegation only zone (g/ccTLD's for
instance) is secure, and it has subs that are not willing to (or can not)
include keys, the super has to have null-keys for them. Instead of having
a null-key for allmost every single delegation (at first, most delegated
zones will not be secure), a wild-card null key (* KEY 49408 3 3) can be
added, making the zone less redundant. Are there any problems with this
sceme ? (I know about the additional complexity (regarding NXT RR) due to
wildcards).

TIA

Roy Arends
-- 
[email-masked]                NLnetLabs
tel +31208884551                Kruislaan 419
|\ ||   _  _|_  |   _ |_  _     1098 VA  Amsterdam
| \||__| )(-|_  |__(_||_)_)     The Netherlands

to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.

---

From: Robert Elz <[email-masked]>
Date: Fri, 07 Apr 2000 01:27:55 +1000

Date:        Thu, 6 Apr 2000 14:28:57 +0200 (CEST)
    From:        Roy Arends <[email-masked]>
    Message-ID:  <[email-masked]>

  | a null-key for allmost every single delegation (at first, most delegated
  | zones will not be secure), a wild-card null key (* KEY 49408 3 3) can be
  | added, making the zone less redundant.

No it can't, wildcards don't work like that.

kre

---

From: Jerry Scharf <[email-masked]>
Date: Thu, 06 Apr 2000 08:49:57 -0700

In the latest rev of secure DNS, the the delegation logic was changed such 
that the parent is no longer reqiured to keep the key for the child if the 
child is secure. So if you find a parent zone running secure and no null key, 
you have to go to the child's NS list and ask for the keys if they don't come 
in the authority section of a query. There were strong operational drives to 
get the live keys out of the parent zone.

Since the null key is an explicit statement that the zone is not secured, your 
solution seems to create a level of ambiguiry. I would fear that could cause 
too many implementation depenent actions.

jerry