Re: DNSSEXT Yokohama Minutes

[Roy Arends <[e-mail]>]

On Mon, 16 Sep 2002, Edward Lewis wrote:

> At 4:16PM +0200 9/16/02, Roy Arends wrote:
> >Please inform me what a resolver should do with the ambiguity of both an
> >unsigned referral and a signed wildcard in a response.
>
> That's the problem.  It's getting harder and harder to tell what
> should be done.
>
> It's clear that a reply should have, barring EDNS1's multiple query
> proposal, 0 or 1 answering RRsets.  (0 means no data/name found.)
> The rest of the answer should be there to support the answer chosen.
>
> The problem is how do you protect answers that should have been
> synthesized from a signed wildcard answer (which does not have to be
> a delegation)

cannot be a delegation (wildcard delegations are not legal).

> from being spoofed away by OPT-IN modified NXT records
> and falsified answers?

I'm stumbling over your words now.

I do understand the problem. The problem is _not_ what should be in a
response, the problem is what a resolver should do with the ambiguity:
Follow unsigned delegation, or assume its a spoof, and go with the signed
wildcard.

Yes, with opt-in as is, you could simply spoof away signed wildcards with
unsecure delegations, and simply spoof away unsecure delegations with
secure wildcards.

How'bout we state in the Opt-In draft that, when using DNSSEC, having both
opt-in and wildcards are illegal.

Roy


--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>