Re: [DNSOP] Working Group Last Call

[神明達哉 <[e-mail]>]

At Tue, 4 Oct 2016 17:39:55 -0400,
Warren Kumari <[e-mail]> wrote:

> > - Section 3: this section also has an issue of "recursive resolver".
> >   Although it may not be as critical as other part of the draft since
> >   it's only used as an example scenario, it's probably better to not
> >   limit the role of resolver to avoid misleading.  Maybe "recursive
> >   resolver" is just changed to "validating resolver", and
> >   "authoritative server" is changed to, e.g., "external servers"
> >   (meaning either authoritative or or other recursive servers).
>
> DONE.
> I did some fix up - how do you like:
> "If a validating resolver gets a query for cat.example.com, it will
> query the example.com servers and will get back an NSEC (or NSEC3)
> record starting that there are no records between apple and elephant.
> The resolver then knows that cat.example.com does not exist; however,
> it does not use the fact that the proof covers a range (apple to
> elephant) to suppress queries for other labels that fall within this
> range. This means that if the validating resolver gets a query for
> ball.example.com (or dog.example.com) it will once again go off and
> query the example.com servers for these names."
>
> Does that cover it sufficiently? (and I think I now better understand
> your concern).

To be perfectly generic, "it will query the example.com servers" is
not always the case.  It (= validating resolver) might query another
intermediate resolver (often called a "forwarder") that performs
recursion.  By "external server" I tried to generalize the concept.

I'm not sure how we address the subtlety without being overly
verbose.  Perhaps we can note in the terminology section that this
draft generally describes (validating) resolvers as those performing
recursive resolution, but the proposal will also work for resolvers
that rely on other recursive (or "full service" if you love to use
this term) resolvers.  And then we can keep Section 3 as is (as of ver
02).

> > - Section 4
> >
> >    We believe this
> >    recommendation can be relaxed because lookups for the specific name
> >    could have come in during the normal negative cache time and so
> >    operators should have no expectation that an added name would work
> >    immediately.  We think that the TTL of the NSEC record is the
> >    authoritative statement of how quickly a name can start working
> >    within a zone.
> >
> >   I'm not necessarily opposed to this claim per se, but IMO it should
> >   provide some more careful justification.  [...]
>
> DONE
> I copied and pasted some text from Cheese Shop and also cleaned up
> this section somewhat.
> I think that I have now managed to successfully explain the reasoning,
> please let me know if you disagree / have suggested text.

Hmm, the new text in 03 doesn't seem to be so different from that of
02 on this point.  But this was actually what we reached as a
consensus I won't rehash it at this point.

> > - Section 5.2
> >
> >    Implementations SHOULD enable aggressive use of NSEC by default.
> >
> >   On a fresh re-read of the draft, I'm now not so sure if this is
> >   clear enough and the requirement is reasonable.  First, does this
> >   also implies an implementation SHOULD implement aggressive use of
> >   NSEC?  Secondly, and especially if the answer to the first point is
> >   'yes', I'm not sure if SHOULD is reasonable.  Since this is just an
> >   optimization, it may be just up to the discretion of the
> >   implementor.
>
> Only implementations which want to support Aggressive NSEC should
> implement Aggressive NSEC. It's up to an implementer to decide if they
> want to have this feature or not.
> I've tried to clarify this with: "Implementations which support
> aggressive use of NSEC SHOULD enable this by default. Implementations
> MAY provide a configuration switch to disable aggressive use of NSEC
> and allow it to be enabled or disabled per domain."

Works for me.

> > - Section 9
> >
> >    Aggressive use of NSEC / NSEC3 resource records without DNSSEC
> >    validation may cause security problems.  It is highly recommended to
> >    apply DNSSEC validation.
> >
> >   This paragraph is awkward.  I pointed this out several times, so I
> >   won't repeat it here - please refer to my previous comments.  One
> >   possibly new perspective is that this tries to cover cases where
> >   NSEC or NSEC3 is somehow cached before/without DNSSEC validation and
> >   note that such records shouldn't be used for the purpose of
> >   nsec-aggressiveuse.  If so, it might make some sense, but in that
> >   case it should be totally rephrased to avoid confusion or
> >   misleading.
>
> DONE.
> How is:
> "Aggressive use of NSEC / NSEC3 resource records without DNSSEC
> validation may create serious security issues, and so this technique
> requires DNSSEC validation."? I don't love it, additional suggestions
> or text welcomed.

To me the main point isn't address with this text.  I might be able to
offer alternative text, but can't we perhaps just remove these 2
sentences?  In a sense these talk about the obvious, and in other
sense it could be even harmful as it can be misleading.

--
JINMEI, Tatuya