Re: [dnsext] Clarifying the mandatory algorithm rules

[Edward Lewis <[e-mail]>]

At 9:10 -0400 3/14/11, Samuel Weiler wrote:

>then presumably we're also changing what it means to be a "properly signed
>zone".  What's the new definition?  And why that change?

Although Sam wrote this, I'm not assuming this is his opinion.

To a validator, whether or not a zone is properly signed should be 
immaterial.  A validator's concern is whether a set of data is 
properly authenticated.

The switch from "signed" to "authenticated" is on purpose, yet 
subtle.  The reason I switched is to switch from a voice of "supply 
side" to "demand side."

As a supply side'r, I'm concerned with how something is accomplished. 
Signing is one basic unit in DNSSEC.  And making sure the zone is 
properly signed is my goal.  "Properly" is relative to the 
specifications, the role of the specs is to set up expectations on 
the other side.

As a demand side'r, I'm concerned with what has been done. 
Authenticating the data is what I am achieving.  Authenticating 
involves first setting the expectation of whether I get the data I 
need (the RRSIG) and then seeing if the expectation is met.

What I am cautioning against is the degree to which a demand side'r 
goes to determine expectations.  A paranoid demand side'r almost 
looks for excuses to declare data unauthentic, and that's bad.  A 
lazy demand side'r avoids looking as much as possible, and that's 
just as bad.  A happy medium is needed.

A happy medium to me is one where the focus is goal-oriented.  If the 
data has a valid signature and I can use a chain of keys up to a 
trusted anchor, then I declare victory.  There's no security problem 
with that.

So, when it comes to validation, we should not even have a definition 
of "properly signed zone."  That is in the domain of the signer.

-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis
NeuStar                    You can leave a voice message at [phone]

Me to infant son: "Waah! Waah! Is that all you can say?  Waah?"
Son: "Waah!"