Re: [dane] Behavior in the face of no answer?

[Andrew Sullivan <[e-mail]>]

On Thu, May 03, 2012 at 04:11:51PM -0700, Paul Hoffman wrote:
> On May 3, 2012, at 3:45 PM, Paul Wouters wrote:
> > 
> > I'm not sure I understand "has no data" in the context of DNSSEC with
> > a validation path (eg DS at the parent).
> 
> A response of SERVFAIL is a response, and it has no data in it.

Aha.  That's not what many people think of when they say "no data".
See section 1 of RFC 2308.  SERVFAIL is actually an error response.
Since SERVFAIL was sort of overloaded in DNSSEC, maybe you want to
call that out.  But what are you going to do with things like NOTIMP,
then?

But I think it still may be possible to get a validated NODATA
response, if you're a non-validating security-aware stub resolver and
your upstream decided not to send you the NSEC or NSEC3 record, but
sent you a response with AD=1, and you had a secure connection.  I
think this would be _stupid_, but I think it's protocol-legal.  (I am
not aware of any implementation that works this way.  Also, I haven't
checked this interpretation tonight, and am therefore prepared to be
wrong.)

> > A response with no data, where there is a DNSSEC chain of trust, is
> > per definition bogus, as your response, even for 'no data' has to come
> > with the signed proof (NSEC/NSEC3)
> 
> That is a reasonable interpretation. Can you point to somewhere in 4033-5 where it says that clearly?
> 

As I say above, I think it depends on whether you think a response
with AD=1 and some assurances about the last hop qualify.  If you
don't, then Paul W is right.

A
-- 
Andrew Sullivan
[e-mail]