Re: [DNSOP] Empty Non-Terminal vs NXDOMAIN in draft-ietf-dnsop-nsec-aggressiveuse

On 10 Oct 2016, at 21:39, Mark Andrews <marka@isc.org> wrote:
> 
> 
> In message <EA312F37-2E4C-45E0-AF0A-B0A0663B73E8@dnss.ec>, Roy Arends writes:
>> Having read the draft
>> 
>> How does one distinguish a Empty Non-Terminal NODATA response from an
>> NXDOMAIN response, solely by looking at the NSEC or NSEC3 records.
> 
> NSEC:  Find the NSEC record that proves that there are no records
> at the given name (note all of the owner, the next domain name and
> the bit map need to be examined to do this).  It either the owner
> name or the next domain name of that record are a subdomain of the
> given name then it is a ENT otherwise it is a NXDOMAIN.

Thanks Mark.

There should be some guidance to this in the draft.

To be complete, for NSEC3: each empty non-terminal has an NSEC3 record associated with it, so there is always a matching NSEC3 record.

The issue remains with NSEC. It is possible to determine the difference. It is important to determine the difference. This method is not specified in the draft that encourages this local optimisation.

Warmly

Roy

> 
>> There is an attack vector where an RCODE0 can be replaced by RCODE3 while
>> keeping the rest of the response completely intact, causing an aggressive
>> use enabled cache to deny existing records.
>> 
>> These kind of subtleties arent described in the draft, as far as I can
>> tell.
>> 
>> Roy
>> _______________________________________________
>> DNSOP mailing list
>> DNSOP@ietf.org
>> https://www.ietf.org/mailman/listinfo/dnsop
> 
> -- 
> Mark Andrews, ISC
> 1 Seymour St., Dundas Valley, NSW 2117, Australia
> PHONE: +61 2 9871 4742                 INTERNET: marka@isc.org