Re: [dnsext] Possible DNSSECbis clarifications

My understanding on these questions...

----- Original Message ----- 
From: "Olafur Gudmundsson" <ogud@ogud.com>
To: <dnsext@ietf.org>
Sent: Monday, March 28, 2011 9:12 AM
Subject: [dnsext] Possible DNSSECbis clarifications

> 
> Dear colleagues,
> 
> The following is a result of a side conversation on the interpretation
> of RFC403x with number of DNS colleagues.
> Any mistakes in the questions are mine.
> 
> The questions are:
> 1) What is the valid order of signed RRsets?
> 2) How many times SHOULD/MUST RRSIG(SOA) appear in an AXFR?
> 3) What RRSIG(SOA)'s MUST appear on the wire in an IXFR transaction?
> 
> 
> Q1) A: In RFC403x there is no order requirement on an signed RRset thus 
> implementations should be ready to handle any combination
> Following Examples should be treated as the same RRset
> RR1 RR3 RRSIG2
> RR2 RRSIG1 RR2
> RR3 RR1 RR3
> RRSIG1 RR2 RRSIG1
> RRSIG2 RRSIG2 RR1
> 

Agreed. Within a section, records may be in any order.
The normal aproach is to have RRSIGs immediately follow that records that
they sign, but this is not required by the standard.

> 
> Q2) In AXFR the SOA record is used as a marker record to signal the 
> beginning of a zone transfer and the end of the zone transfer.
> The open question is how many times should RRSIG(SOA) appear in the
> AXFR stream ?
> a) Only once
> b) Both times
> c) Does not matter both are ok.
> 
> if the answer is a) then the question is when should it appear,
> i) in the beginning after the SOA
> ii) at any time in the AXFR
> iii) just before the final one.
> iv) after the final one.

RRSIG(SOA) records should be anywhere after initial SOA and before the final SOA record.

> Q3) In IXFR there are multiple SOA records used as maker both on the 
> overall transaction and on each delta.
> The questions here are:
> Which RRSIG(SOA) i.e. for each serial number, are needed ?
> a) All of them once
> b) all of them each time SOA appears
> b) only the final one, all the other ones are immaterial
>   (open question is how often and where)
> c) The first and last one and each only once,
>    the first one is needed to identify what to delete from
>    the zone, the final one is what is going to be in the
>            zone after the IXFR is applied.
> 

I'm not familiar with IXFR, so no opinion on this one.

George

> Is there need put this information in dnssec-bis (the answer to the AXFR 
> question may update RFC5936) and in IXFR-bis document ?
> 
> Olafur
> 
> _______________________________________________
> dnsext mailing list
> dnsext@ietf.org
> https://www.ietf.org/mailman/listinfo/dnsext