Interpreting DNSSEC was Re: [dnsext] flip-flopping secure and unsecure DNAME/CNAME

[Edward Lewis <[e-mail]>]

At 15:18 +0100 10/13/08, Alex Bligh wrote:

>1. We have data, which we know is correct & secure (DNSSEC signatures
>   verify)

>3. We have data, but we are uncertain as to the correctness of the
>   data (e.g. no DNSSEC information for that zone, or missing DLV
>   or whatever).

DNSSEC says nothing about "correctness." If the IP address is typed 
wrong by the zone admin, DNSSEC will sign the result.

"Missing DLV" is something that cannot be diagnosed from the packet 
arriving on port 53.  If you have no trust anchor for a name and you 
get signed data owned by that name, it is indistinguishable whether 
the name has a key and you don't know it ("missing DLV") versus 
someone inserting falsely signed data just so you deduce it is 
missing.

DNSSEC only says "this answer looks good" or "doesn't look good." 
Trying to figure out whether the answer's disposition is 
temporary/permanent, correct/incorrect, trustworthy/not takes more 
than just the DNS data and more than just the query at hand.
-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                                [phone]
NeuStar

Never confuse activity with progress.  Activity pays more.

--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>