Re: [dane] Behavior in the face of no answer?

[Eric Rescorla <[e-mail]>]

On Fri, May 4, 2012 at 9:55 AM, Andrew Sullivan <[e-mail]> wrote:
> On Fri, May 04, 2012 at 08:10:40AM -0700, Eric Rescorla wrote:
>> > we usually call "NODATA".  The case I mentioned yesterday, where AD is
>> > set and the upstream doesn't give you the DNSSEC data and you have a
>> > NODATA response is, AFAICT, just a case where there is no TLSA RRset
>> > and shouldn't result in TLS failure.
>>
>> But the problem is that this is indistinguishable from the case where there
>> *was* a TLSA RRSET and you have a network attacker.
>
> It certainly isn't.  If you're depending on your upstream validator,
> you need to trust it.  If you don't trust it, don't depend on the
> upstream, in which case you're not going to offload validation.
>
> A NODATA answer is _not_ just like "no response at all" if the answer
> passed validation, and if it didn't pass the the specification already
> covers this case.

I'm sorry, I think we're still talking past each other. If you treat
non-response
the same way as you treat a validated empty RRSET, then a network
attacker can get the same effect (i.e., no DANE checks) by simple
suppressing DNS resolution.

-Ekr