[dnsext] RFC 4035 and "caching" of "expired RRSIG's"

["Marc Lampo" <[e-mail]>]

Hello group,
and my best whishes for a healthy and challenging 2011 !

Allow me to throw a question about "caching" of "expired RRSIG's".
In RFC4035, DNSSEC “protocol”, in section 4 : “Resolving”
4.5.  Response Caching

   A security-aware resolver SHOULD cache each response as a single
   atomic entry containing the entire answer, including the named RRset
   and any associated DNSSEC RRs.  The resolver SHOULD discard the
   entire atomic entry when any of the RRs contained in it expire.

In a preceding paragraph on “Recursive Name Servers” (3.2), it reads :
   The resolver side follows the usual rules for caching and negative
   caching that would apply to any security-aware resolver.

--> I interpret that the discarding of an entire atomic entry
    when (even at least) one RRSIG in it expire (even though others may be
still be valid)
    is a recommendation (only).

There are two aspects I feel might need some explicit clarification :
1) the "should", from 4.5, is to be interpreted as : "recommended"
    and "developer, know what you are doing when you do not implement
this"
    (free after rfc 2119)
   Consequently :
    some name server implementations/versions may chose to cache expired
RRSIG's

2) "*any* of the RRs ... expire"
   Fact is that multiple RRSIG's may be available,
    not all of which expired,
    and those that are still valid, may allow to perform full DNSSEC
validation.
   If taken literally, name servers that do implement discarding according
to 4.5 of RFC4035
    might not cache otherwise valid info (RRset + related RRSIG(set))
    as soon as one of the RRSIG's expires.
   As this might defeat the functioning of caching
    - there are name servers that almost continuously return an expired
RRSIG,
      In the presence of other, not expired, RRSIG(s) that do allow DNSSEC
validation -
   if at leased one received RRSIG is already expired upon reception.

   Consequently :
    Wouldn't it be wise to rephrase 4.5 of RFC4035 such that
     "DNSSEC validation becomes impossible"
    is meant ?


At this moment, as eu. top-level domain, we continue
to warn for RRSIG's that may expire while in some cache.
(because throwing them out of the cache is "recommended" only).
We feel this is in the interest of optimal DNSSEC operation.


Thanks for sharing your feedback.


Kind regards,


Marc Lampo
Security Officer
 
    EURid
    Woluwelaan 150    
    1831 Diegem - Belgium
    [e-mail]
    http://www.eurid.eu

Register your .eu domain name and win an iPod touch this X-Mas
http://www.winwith.eu