Re: [DNSOP] I-D Action: draft-ietf-dnsop-delegation-trust-maintainance-01.txt

Matthijs Mekking <matthijs@nlnetlabs.nl> Thu, 09 January 2014 09:06 UTC

Return-Path: <matthijs@nlnetlabs.nl>
X-Original-To: dnsop@ietfa.amsl.com
Delivered-To: dnsop@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 63CFC1ADFFC for <dnsop@ietfa.amsl.com>; Thu, 9 Jan 2014 01:06:20 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -100.444
X-Spam-Level:
X-Spam-Status: No, score=-100.444 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HELO_EQ_NL=0.55, HOST_EQ_NL=1.545, RP_MATCHES_RCVD=-0.538, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8aAoXHgM0zwH for <dnsop@ietfa.amsl.com>; Thu, 9 Jan 2014 01:06:19 -0800 (PST)
Received: from open.nlnetlabs.nl (open.nlnetlabs.nl [IPv6:2001:7b8:206:1::1]) by ietfa.amsl.com (Postfix) with ESMTP id B76091ADFEF for <dnsop@ietf.org>; Thu, 9 Jan 2014 01:06:18 -0800 (PST)
Received: from [213.154.224.18] (zoidberg.nlnetlabs.nl [213.154.224.18]) (authenticated bits=0) by open.nlnetlabs.nl (8.14.7/8.14.4) with ESMTP id s09963gc085025 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT); Thu, 9 Jan 2014 10:06:05 +0100 (CET) (envelope-from matthijs@nlnetlabs.nl)
Authentication-Results: open.nlnetlabs.nl; dmarc=none header.from=nlnetlabs.nl
DKIM-Filter: OpenDKIM Filter v2.8.3 open.nlnetlabs.nl s09963gc085025
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=nlnetlabs.nl; s=default; t=1389258367; bh=8e8x1emKC4XtWgTy+eFn150pmc8MLH6Kjj1IwzqnaYI=; h=Date:From:To:CC:Subject:References:In-Reply-To; b=bfi6I8k8WLcVlNDk02y7rGtYBF4m9dnZ2Yihfr36rEzFwg01TT71UB0mwm5UzdIs2 kQtZiseGC0OuI6WN66B/6qqelAe5Yenj4QadZ9VyqM7qJJ90qWzqib0ObDG6qf/446 Q1oFZyNN1ZoI9sBGDvJE10En8t7Kbq/IMnrRsXpg=
X-Authentication-Warning: open.nlnetlabs.nl: Host zoidberg.nlnetlabs.nl [213.154.224.18] claimed to be [213.154.224.18]
Message-ID: <52CE667B.7020802@nlnetlabs.nl>
Date: Thu, 09 Jan 2014 10:06:03 +0100
From: Matthijs Mekking <matthijs@nlnetlabs.nl>
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Thunderbird/24.2.0
MIME-Version: 1.0
To: Olafur Gudmundsson <ogud@ogud.com>
References: <20140104204035.7446.24984.idtracker@ietfa.amsl.com> <CAHw9_iKbHbt7+j=C2ub=vRR+0rNgU+3P=WjnpV4gnY=y=q4xOQ@mail.gmail.com> <20140104235045.GA24696@totoro.home.mukund.org> <28570EA3-CF74-4FD2-95CD-D8672E64C199@ogud.com> <52CD145E.8060801@nlnetlabs.nl> <04EA28D3-8186-4743-B66B-1F1C06A57524@ogud.com>
In-Reply-To: <04EA28D3-8186-4743-B66B-1F1C06A57524@ogud.com>
X-Enigmail-Version: 1.5.2
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.4.3 (open.nlnetlabs.nl [213.154.224.1]); Thu, 09 Jan 2014 10:06:06 +0100 (CET)
Cc: "dnsop@ietf.org WG" <dnsop@ietf.org>
Subject: Re: [DNSOP] I-D Action: draft-ietf-dnsop-delegation-trust-maintainance-01.txt
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/dnsop/>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 09 Jan 2014 09:06:20 -0000

On 01/09/2014 05:40 AM, Olafur Gudmundsson wrote:
> 
> On Jan 8, 2014, at 4:03 AM, Matthijs Mekking <matthijs@NLnetLabs.nl> wrote:
> 
>> On 01/08/2014 05:53 AM, Olafur Gudmundsson wrote:
>>> Note; 
>>> This case is one of the reasons I want children to remove the C* records after parent performs the update, 
>>> then there is no chance of JoJo updates by parent depending on which Nameserver is polled. 
>>
>> But the parent would still need to deal with the case that the C* is the
>> same: The child may not yet have removed the record because it had not
>> yet come to the conclusion that all DS records at the parent name
>> servers are in sync. In this scenario, the parent shall also not take
>> action (just like if there was no C* RRset).
>>
>> I think looking at the inception time is a better approach to prevent
>> JoJo updates.
> 
> 
> So you want an Parental Agent to look inside the RRSIG(s) as tiebreaker ?

Yes. And I don't see any harm in that: The Parental Agent already has to
check the packet because of the Continuity rule.

Best regards,
  Matthijs

> 
> 	Olafur
> 
> 
>