[dnsext] bitmap inference was Re: ... - NXDOMAIN for emptynon-terminals

[Edward Lewis <[e-mail]>]

At 18:16 +0100 3/29/11, George Barwood wrote:

>What I'm saying is that an NSEC bitmap tells a client the complete set
>of types that don't exist for a domain,

That's wrong.  The bitmap presents information signed by the 
authority demonstrating that the type you requested does not exist at 
the name.

The way it is supposed to work is - you ask for fqdn.tld. A record. 
The response comes back with an empty answer section and an SOA and 
NSEC/3 in the authority demonstrating that the requested type is not 
there.

The tradeoff here is that the NSEC can be replayed to deny the 
existence of another type to save having to manage multiple NSEC 
records for a name.

I'm not going to debate the tradeoff.  Obviously there are two sides 
to the story, and whether there is a gain in reducing the number of 
NSEC/3's to manage.  But I am against changing the specification to 
close off the debate.

If the specifications are changed, the net result is giving more 
authority to the caches and taking the debate away from the 
authoritative portion of the system.  That is why I resist extending 
the inferences based on NSEC/3 bitmaps.

The subject line was NXDOMAIN.  I'm not talking about that.  We 
already carefully considered that in the development of DNSSEC and 
have the results documented.
-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis
NeuStar                    You can leave a voice message at [phone]

Me to infant son: "Waah! Waah! Is that all you can say?  Waah?"
Son: "Waah!"