Re: [DNSOP] Working Group Last Call draft-ietf-dnsop-resolver-priming

[Stephane Bortzmeyer <[e-mail]>]

On Thu, Aug 04, 2016 at 08:03:35PM -0400,
 Tim Wicinski <[e-mail]> wrote 
 a message of 27 lines which said:

> This starts a Working Group Last Call  for draft-ietf-dnsop-resolver-priming

I know, it's too late (damned holidays) but I think the document is
OK, I just suggest a few additions:

Section 3.3: Replace the first two sentences by:

The resolver MAY set the DNSSEC OK [RFC4033] bit.  At the time this
document is being published, there is little use to performing DNSSEC
validation on the priming query. This is because all root name servers
are under a separate zone, "root-servers.net" (delegated to the root
name servers). The resolver will eventually need AAAA and A RRsets of
the NS names in this zone. But the "root-servers.net" zone is not
signed. So a man-in-the-middle attack on the priming query can result
in malicious data in the responses.

(it was proposed and explained in
<https://mailarchive.ietf.org/arch/msg/dnsop/c09YZDWvSbcuNxQbDshICQdW5IE>)

Same section 3.3, at the end, add:

Note a validating resolver won't accept responses from rogue root name
servers, if they are different from the real responses, since the
resolver has a trust anchor for the root and the answers from the root
are signed. So, if there is a man-in-the-middle attack on the priming
query, the only result for a validating resolver will be a denial of
service.

Section  5, add a reference to section 3.3, after "DNSSEC".

There is also a small contradiction between the abstract ("and the
necessary address information for reaching the root servers") and
section 4.1 ("There ___may be___ an Additional section with A and/or
AAAA RRSets").

Two personal questions (I cannot find a discussion on these two points
in the archive):

Section 4.1 "There may be an Additional section with A and/or AAAA
RRSets" There is no mention of what the resolver should do if this
section is missing. Sending a query XXX.root-servers.net/AAAA to the
same authoritative server used for the priming?

Section 4.2 "a resolver SHOULD consider the address information found
in the Additional section complete for any particular server that
appears at all" Why this rule? (Most root name servers, when the
advertised buffer is too small, sacrifice IPv6 addresses.)