Re: [dnsext] Reminder: two WGLC closing in one week

[Michael StJohns <[e-mail]>]

Hi Andrew -

At Scott's request I took a look at the dname document.  Keep in mind that I'm looking at it pretty much for the first time.  Unfortunately, I don't think its ready for prime-time.  Most of the document is fine - but the section on DNSSEC is woefully lacking.

DNSSEC unfortunately makes things more difficult.  Having DNAMEs plus DNSSEC stretches the complications almost to the breaking.


The section needs more than a 1 page description of why DNSSEC servers need to understand DNAME, it needs a discussion of the various combinations of modes in which a resolver can find itself when following a DNAME chain.

For example - what happens if the DNAME is signed, but the referenced target isn't?  What happens if both are signed, but the resolver doesn't have a trust anchor for the target but has one for the DNAME? For the DNAME but not the target?  What happens if the DNAME is directly reachable (e.g. querier is a validating recursive resolver) but the target is available only through a forwarder?  What happens if the DNAME and the target are signed with different algorithm and the querier only understands one of they.

I can see about a number of  different ways to have different resolvers behave given different combinations.  I think they need to be called out and a specific behavior proposed for each prior to sending this forward.

One proposal, once the "must be signed bit" is set (e.g. DNAME or target subordinate to a trust anchor without a delegation to unsecure), then ALL data must be signed to be considered valid.  (Not sure this is the right way of doing things, but its a conversation starter).

Sorry - Mike



At 08:45 PM 9/18/2008, Andrew Sullivan wrote:
>Dear colleagues,
>
>This is a reminder that there are two outstanding WGLC open, and that
>they both expire in one week.  They are for the following two
>documents:
>
>draft-ietf-dnsext-rfc2672bis-dname-14.txt 
>
>draft-ietf-dnsext-dnssec-rsasha256-05.txt
>
>The WGLC for both of these have already been extended in order to
>address concerns that many people were on vacation in August.  By my
>count, we're not quite to the threshold of reviewers with either of
>these.  _PLEASE read them and comment_, or else, by the conventions
>adopted by the working group, they'll have to die as far as the
>working group is concerned.  Given that we took both of these on as WG
>items, we owe it to our colleagues who have worked on them to perform
>the review.
>
>Thanks, and best regards,
>
>Andrew (for the chairs)
>
>-- 
>Andrew Sullivan
>[e-mail]
>[phone] x104
>http://www.commandprompt.com/
>
>--
>to unsubscribe send a message to [e-mail] with
>the word 'unsubscribe' in a single line as the message text body.
>archive: <http://ops.ietf.org/lists/namedroppers/>



--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>