Re: [dnsext] RFC 4035 and "caching" of "expired RRSIG's"

["Marc Lampo" <[e-mail]>]

Hello,

I understand what you mean, but the RFC uses the word "expire".
And that, by itself, can be interpreted in two ways :
1) the ttl counts down to 0
2) the present time is later then the "expiration date" of the (a ?) RRSIG
record

You indicate that this portion of the RFC handles TTL only,
 but the last paragraph of that section 4.5 states :
 "until the TTL or signatures ... expire"
 --> this leads to believe that it is not exclusively TTL only
That possible, dual, interpretation indicates the need for clarifation, I
would say.


And, if the original RFC meant the TTL only,
then the case of an RRSIG past expiration time (second interpretation
above)
 is not addressed at all, is it ?

Furthermore, since TTL of RRSIG RRset must be identical to the TTL of the
RRset it signs,
all records in the "atomic entry" should have the same TTL anyway.
Though I suppose that somehow, data might arrive/be refreshed at different
times,
yielding different TTL values in a validating name servers cache.

Kind regards,

Marc


-----Original Message-----
From: Florian Weimer [mailto:[e-mail]]
Sent: 04 January 2011 11:05 AM
To: Marc Lampo
Cc: [e-mail]
Subject: Re: [dnsext] RFC 4035 and "caching" of "expired RRSIG's"

* Marc Lampo:

>    Consequently :
>     Wouldn't it be wise to rephrase 4.5 of RFC4035 such that
>      "DNSSEC validation becomes impossible"
>     is meant ?

Please clarify if you're concerned with TTLs or signature validity
periods.  (The quoted sections in the RFCs are strictly about TTLs,
and not about cryptographic constraints.)

--
Florian Weimer                <[e-mail]>
BFK edv-consulting GmbH       http://www.bfk.de/
Kriegsstraße 100              tel: [phone]
D-76133 Karlsruhe             fax: [phone]

Register your .eu domain name and win an iPod touch this X-Mas
http://www.winwith.eu