Re: DNSSEXT Yokohama Minutes

[David Blacka <[e-mail]>]

>>>>> "Roy" == Roy Arends <[e-mail]> writes:

 Roy> The other (main) issue is caching of NXT/SIG(NXT). When not
 Roy> individually queried for, they MUST be cached as properties of
 Roy> QNAME/QCLASS/QTYPE or as an integral part of the entire
 Roy> answer. They MUST NOT be stored as individual records. However,
 Roy> these are DNSSEC issues which are inherited by Opt-In. In other
 Roy> words, caches are not more then a "response replay" box, which
 Roy> is only allowed to alter the TTLs of records and the
 Roy> [E]DNS-header.
 >> 
 >> I do not understand the harm in also caching the NXTs as individual
 >> records.  This is probably because I do not fully understand the
 >> corner case you and Rob Austein investigated.

 Roy> Wait, thats not what I wrote. When explicitly queried for, yes, the cache
 Roy> can replay the response if, and only if it was cached as result of a
 Roy> previous explicit query for that NXT.

What I was really asking is why the "only if it was cached as result
of a previous explicit query for that NXT" condition?

If I get NXT records (opt-in or otherwise) in the authority section of
a response, I need to cache these NXTs as properties of the qname, but
why can't I ALSO cache them as ordinary records?

 Roy> Sure, explicit queries for qtype NXT are okay, as long as cache
 Roy> follows the query, and NOT _reconstruct_ responses from
 Roy> cache. If it has been cached as an individual
 Roy> QNAME/QCLASS/QTYPE, than the cache can simply respond that. But
 Roy> again, simply replay the response, not reconstruct.

Specifically, what pitfalls exist in reconstructing a positive
response to an explit NXT query?

The reason I am pursuing this is that I'm trying to imagine how I
would build a cache, and I am thinking that I would like to store the
NXT records just like any other record in my cache, while having other
cache values have pointers to it (rather than storing the NXT set in
toto with the original qname).

-- 
David Blacka    <[e-mail]> 
Sr. Engineer    Verisign Applied Research

--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>