Re: [dane] Behavior in the face of no answer?

[Martin Rex <[e-mail]>]

Eric Rescorla wrote:
> 
> On Thu, May 3, 2012 at 3:45 PM, Paul Wouters <[e-mail]> wrote:
> > On Thu, 3 May 2012, Paul Hoffman wrote:
> > A response with no data, where there is a DNSSEC chain of trust, is
> > per definition bogus, as your response, even for 'no data' has to come
> > with the signed proof (NSEC/NSEC3)
> >
> > I would just leave out "or the response has no data"
> 
> I should probably mention that the analysis I am offering applies to any
> other non-cryptographically verifiable error case, such as ICMP
> errors, unverifiable SERVFAILs, etc. It's not clear to me if these
> are all treated as Bogus but in this context I claim they must
> be.


While I do agree with your analysis, I'm inclined to believe that
an unconditional hard-fail is as realistic for DANE as a hard-fail
is for OCSP response failures.  A non-marginal number of
TLS clients (WinXP using MSIE) is IMHO not even attempting OCSP
lookups at all.  And while I personally use FF 3.6, I have
OCSP purposely disabled and Certificate Patrol installed.

The difficulty with DNSSEC is that there are many firewalled networks
with either private DNS universes as well as NATed networks with DHCP and
local, DNSSEC-unaware recurive DNS resolvers, where a DANE hard-fail
approach might result in severe usability issues.

Is there any reliable data on the availability of 100% correctness
of DNSSEC records from places with full&transparent internet
connectivity to DNSSEC-capable recursive DNS resolvers?

-Martin