IETF Logo Mail Archive

[DNSOP] Re: Secdir early review of draft-ietf-dnsop-compact-denial-of-existence-04

John Levine <johnl@taugh.com> Wed, 31 July 2024 02:40 UTC

Return-Path: <johnl@iecc.com>
X-Original-To: dnsop@ietfa.amsl.com
Delivered-To: dnsop@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 10D4BC151091 for <dnsop@ietfa.amsl.com>; Tue, 30 Jul 2024 19:40:58 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.857
X-Spam-Level:
X-Spam-Status: No, score=-1.857 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.25, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=iecc.com header.b="AcJveoVf"; dkim=pass (2048-bit key) header.d=taugh.com header.b="CTZfkIKJ"
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Eikq6FcNghIY for <dnsop@ietfa.amsl.com>; Tue, 30 Jul 2024 19:40:53 -0700 (PDT)
Received: from gal.iecc.com (gal.iecc.com [IPv6:2001:470:1f07:1126:0:43:6f73:7461]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 016D2C14F6B7 for <dnsop@ietf.org>; Tue, 30 Jul 2024 19:40:52 -0700 (PDT)
Received: (qmail 27337 invoked from network); 31 Jul 2024 02:40:50 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed; d=iecc.com; h=date:message-id:from:to:cc:subject:in-reply-to:references:mime-version:content-type:content-transfer-encoding:cleverness; s=6ac666a9a432.k2407; bh=9dJUepJxOZxjAS6YI8BHKL4GWJKFGM2BZhCePTOhty8=; b=AcJveoVfYRXq8LyQ1hBhEVUaFAY7FF6TkRsR/Y7m9nL2bs984qVmw2xBMFzzgMZEpdjBkjCSmpyGFDJQkMg4MKf7D+40GJeaLTb22t1/fjpO5jDg+Q9u7aqPsLqUq+DksRvnzPB/DKxqvrgL7QmZBmpOhMUpfgmSEvkl4VUHg5saCgqY81a7ug/PWFY/1ZB4cicyQcfq7UaSUMbkC2d+arqS6GJR4voJFK1LHtzTlr0K7bfmn/5H4Hr+mt3w1VnRJnKW3dlvm85NlxAD2Ka1R7gvVpvqkO5UcbVd7vywx24Z/Zfe1O8aK2XeVO0sdaY7qDmquRn7FFtLIXCrbGcDBQ==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed; d=taugh.com; h=date:message-id:from:to:cc:subject:in-reply-to:references:mime-version:content-type:content-transfer-encoding:cleverness; s=6ac666a9a432.k2407; bh=9dJUepJxOZxjAS6YI8BHKL4GWJKFGM2BZhCePTOhty8=; b=CTZfkIKJOmA3Df+9/2QAsyGMfzgmy+oEQ8eFWmSF3c2PCVjbB9WbdGV9ZQhRe0c2Tp0jCg2KLKntQoYYCIw4+t+EqMo5Y7mU8EsYlpE8CJxTHpEq1xUZT+vqTHxZEWJAU5o+eVhcfm6+6fTUV11CKX3mdkQQ8uQsbcyYs9jqmyzGp9G2ZiKViMDu5VasL5lA/BMRFtzZTuATfBSAvllSfBq2pd/goebF7e9GgKF59IKnv8sSlzru57hU4bK0zWKrG6PeR+iVS13ZUmL3yW/3MMKeDSmDDG3lHgRaQG6Fr8+ap2tqI0Uf6nEXcOzsB0rpikxwmSnc/SKCXkDc8/cJTw==
Received: from ary.qy ([IPv6:2001:470:1f07:1126::78:696d:6170]) by imap.iecc.com ([IPv6:2001:470:1f07:1126::78:696d:6170]) with ESMTPS (TLS1.3 ECDHE-RSA CHACHA20-POLY1305 AEAD) via TCP6; 31 Jul 2024 02:40:50 -0000
Received: by ary.qy (Postfix, from userid 501) id 63B049098839; Tue, 30 Jul 2024 22:40:48 -0400 (EDT)
Date: Tue, 30 Jul 2024 22:40:48 -0400
Message-Id: <20240731024049.63B049098839@ary.qy>
From: John Levine <johnl@taugh.com>
To: dnsop@ietf.org
In-Reply-To: <CAHPuVdXYqoKjeO18kXoud2YO6KO_FL=m2xSjqQ7QdwV2mLi8Qg@mail.gmail.com>
Organization: Taughannock Networks
References: <172238346320.1988233.11549951810315868557@dt-datatracker-659f84ff76-9wqgv> <d62f53f0-fe73-4e35-84cb-ddda704a73eb@brokendns.net> <CAHPuVdXYqoKjeO18kXoud2YO6KO_FL=m2xSjqQ7QdwV2mLi8Qg@mail.gmail.com>
X-Headerized: yes
Cleverness: minimal
Mime-Version: 1.0
Content-type: text/plain; charset="utf-8"
Content-transfer-encoding: 8bit
Message-ID-Hash: 7EGTXK3N3HLCADH7NLFPS76HJ36GAFRP
X-Message-ID-Hash: 7EGTXK3N3HLCADH7NLFPS76HJ36GAFRP
X-MailFrom: johnl@iecc.com
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-dnsop.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
X-Mailman-Version: 3.3.9rc4
Precedence: list
Subject: [DNSOP] Re: Secdir early review of draft-ietf-dnsop-compact-denial-of-existence-04
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/a6uLnLKeuYZk4W8TEgW_EnDqYtA>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Owner: <mailto:dnsop-owner@ietf.org>
List-Post: <mailto:dnsop@ietf.org>
List-Subscribe: <mailto:dnsop-join@ietf.org>
List-Unsubscribe: <mailto:dnsop-leave@ietf.org>

It appears that Shumon Huque  <shuque@gmail.com> said:
>-=-=-=-=-=-
>
>Thank you Michael,
>
>Your observation is certainly true. However, I want to point out that
>inability to
>synthesize NXDOMAIN via aggressive negative caching applies to any online
>signing scheme that uses minimally covering NSEC, not just Compact DoE.

It's also what happens with no DNSSEC at all, give or take larger
responses. I think we can agree to note it but there's nothing to do
about it.

I have to say it's amusing that now it's a security issue *not* to
implement RFC 8198. When I suggested NXDOMAIN synthesis twenty years
ago as a way to speed up sparse IPv6 DNSBL queries, the dnsop crowd
firmly told me that I was an idiot even to propose it, and the only
valid approach was to get nice fresh answers from the authoritative
servers each time.

R's,
John

v2.26.15 | Report a Bug | By Email | System Status