Re: [dnsext] flip-flopping secure and unsecure DNAME/CNAME

[Wouter Wijngaards <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi Michael,

I think it is much simpler than that. The application is interested in
what is known with certainty.
1. It is certain the data is valid (secure)
2. It is certain that security checks failed (bogus)
3. whatever (insecure).

Thus, your numbers 1, 3, 5 are folded into insecure (or maybe more
accurately, 'no security available').

A mail application could deliver 1 and 3, but not 2(bogus).  Or it might
examine the AD bit on replies and only deliver 1.

When a DNAME or CNAME chain crosses a BOGUS entry, the DNAME or CNAME
chain result is bogus. When a DNAME or CNAME chain has all items secure,
the DNAME or CNAME chain result is secure.  All other cases are insecure
(i.e. the chain has one insecure element and the other elements are
insecure or secure).

I do not think a 'must be secure' bit is needed.  Only when all items in
the chain are secure is the result secure, and does the AD bit get set.

Best regards,
   Wouter

Michael StJohns wrote:
> At 01:36 AM 10/13/2008, Ben Laurie wrote:
>> 1. RR exists and here it is.
>> 2. RR does not exist.
>> 3. Server not reachable (or otherwise broken).
>>
>> to
>>
>> 1. RR exists and here it is.
>> 2. RR does not exist.
>> 3. RR exists but is broken in some way.
>> 4. Server not reachable (or otherwise broken).
> 
> I don't think its this simple... really.
> 
> Basic DNS has the 3 answers in your first group - although I'd categorize the last one as "I can't make any determination about whether or not the answer exists for any of a number of reasons" - what Marc describes as "indeterminate".
> 
> DNSSEC  add 4 (actually maybe even 5) security states that are somewhat orthogonal to the DNS states:
> 
> 1. Unknown - I've got no superior trust anchor so I can't make any definite statement about whether or not the answer is secure.
> 2.  Secure - I've gotten a chain of signatures covering which allow me to determine the answer is securely valid.
> 3.  Unsecure - I've gotten a chain of signature plus certain other data which tells me in a secure manner that I have no security information about the final answer.
> 4.  Bogus - I've gotten all the information I've asked for from the system, but I was unable to prove the security - bad signatures, missing keys, etc.
> 5.  Insecure transition from secure - I've got valid signatures as far as a CNAME or DNAME, but the CNAME or DNAME point into an area of the tree with Unknown trust.
> 
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iEYEARECAAYFAkjzPDQACgkQkDLqNwOhpPg4hgCfZJrXXhwSeXgeZiU9W4FZ5Wwi
O84AoKnIBWKPbaVGzxeCueQWk5L0WslT
=tjtc
-----END PGP SIGNATURE-----

--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>