Re: [homenet] Eric Rescorla's Discuss on draft-ietf-homenet-dot-13: (with DISCUSS)

On Thu, Aug 31, 2017 at 8:39 PM, Mark Andrews <marka@isc.org> wrote:

>
> In message <150413520708.16860.14531912464478386147.
> idtracker@ietfa.amsl.com>,
> Eric Rescorla writes:
> > Eric Rescorla has entered the following ballot position for
> > draft-ietf-homenet-dot-13: Discuss
> >
> > When responding, please keep the subject line intact and reply to all
> > email addresses included in the To and CC lines. (Feel free to cut this
> > introductory paragraph, however.)
> >
> >
> > Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.
> html
> > for more information about IESG DISCUSS and COMMENT positions.
> >
> >
> > The document, along with other ballot positions, can be found here:
> > https://datatracker.ietf.org/doc/draft-ietf-homenet-dot/
> >
> >
> >
> > ----------------------------------------------------------------------
> > DISCUSS:
> > ----------------------------------------------------------------------
> >
> >        A.  Recursive resolvers at sites using 'home.arpa.'  MUST
> >            transparently support DNSSEC queries: queries for DNSSEC
> >            records and queries with the DO bit set ([RFC4035] section
> >            3.2.1).  While validation is not required, it is strongly
> >            encouraged: a caching recursive resolver that does not
> >            validate answers that can be validated may cache invalid
> >            data.  This in turn will prevent validating stub resolvers
> >            from successfully validating answers.
> >
> > I don't understand the rationale for this requirement. As I understand it
> > from this document, stuff ending in home.arpa cannot be DNSSEC validated,
> > so what's it the business of this document to levy the requirement on
> > sites which support home.arpa that they do anything with DNSSEC at all.
>
> Wrong the responses can be validated.  The output of the validation
> step is one of secure, insecure, or bogus.  With the exception of
> home.arpa/DS and without private trust anchors being installed the
> output of that validation should be insecure for all answers from
> home.arpa.  home.arpa/DS should validate as secure NODATA.
>
> In particular validation of the home.arpa/DS is important as it
> prevents the cache being poisoned with answers which prevent the
> stub proving that the home.arpa is supposed to exist and that it
> doesn't have a chain of trust from the root.
>

I don't see how this is different from any other kind of resolution.

-Ekr

> Mark
>
> > _______________________________________________
> > homenet mailing list
> > homenet@ietf.org
> > https://www.ietf.org/mailman/listinfo/homenet
> --
> Mark Andrews, ISC
> 1 Seymour St., Dundas Valley, NSW 2117, Australia
> PHONE: +61 2 9871 4742                 INTERNET: marka@isc.org
>