Re: [homenet] Eric Rescorla's Discuss on draft-ietf-homenet-dot-13: (with DISCUSS)

On Sat, Sep 2, 2017 at 6:38 PM, Warren Kumari <warren@kumari.net> wrote:

> On Fri, Sep 1, 2017 at 10:41 AM, Eric Rescorla <ekr@rtfm.com> wrote:
> >
> >
> > On Thu, Aug 31, 2017 at 8:39 PM, Mark Andrews <marka@isc.org> wrote:
> >>
> >>
> >> In message
> >> <150413520708.16860.14531912464478386147.idtracker@ietfa.amsl.com>,
> >> Eric Rescorla writes:
> >> > Eric Rescorla has entered the following ballot position for
> >> > draft-ietf-homenet-dot-13: Discuss
> >> >
> >> > When responding, please keep the subject line intact and reply to all
> >> > email addresses included in the To and CC lines. (Feel free to cut
> this
> >> > introductory paragraph, however.)
> >> >
> >> >
> >> > Please refer to
> >> > https://www.ietf.org/iesg/statement/discuss-criteria.html
> >> > for more information about IESG DISCUSS and COMMENT positions.
> >> >
> >> >
> >> > The document, along with other ballot positions, can be found here:
> >> > https://datatracker.ietf.org/doc/draft-ietf-homenet-dot/
> >> >
> >> >
> >> >
> >> > ------------------------------------------------------------
> ----------
> >> > DISCUSS:
> >> > ------------------------------------------------------------
> ----------
> >> >
> >> >        A.  Recursive resolvers at sites using 'home.arpa.'  MUST
> >> >            transparently support DNSSEC queries: queries for DNSSEC
> >> >            records and queries with the DO bit set ([RFC4035] section
> >> >            3.2.1).  While validation is not required, it is strongly
> >> >            encouraged: a caching recursive resolver that does not
> >> >            validate answers that can be validated may cache invalid
> >> >            data.  This in turn will prevent validating stub resolvers
> >> >            from successfully validating answers.
> >> >
> >> > I don't understand the rationale for this requirement. As I understand
> >> > it
> >> > from this document, stuff ending in home.arpa cannot be DNSSEC
> >> > validated,
> >> > so what's it the business of this document to levy the requirement on
> >> > sites which support home.arpa that they do anything with DNSSEC at
> all.
> >>
> >> Wrong the responses can be validated.  The output of the validation
> >> step is one of secure, insecure, or bogus.  With the exception of
> >> home.arpa/DS and without private trust anchors being installed the
> >> output of that validation should be insecure for all answers from
> >> home.arpa.  home.arpa/DS should validate as secure NODATA.
> >>
> >> In particular validation of the home.arpa/DS is important as it
> >> prevents the cache being poisoned with answers which prevent the
> >> stub proving that the home.arpa is supposed to exist and that it
> >> doesn't have a chain of trust from the root.
> >
> >
> > I don't see how this is different from any other kind of resolution.
>
> Jumpin' in the middle here.
>
> The root proves that .arpa exists. .arpa proves that home.arpa exists,
> but, as there is no DS record, it also proves that names under
> home.arpa are insecure, and so we can create foo.home.arpa,
> bar.home.arpa, etc.
>
> If recursive resolvers at sites using 'home.arpa.'  DID NOT
> transparently support DNSSEC queries, then validating stubs would not
> be able to query the .arpa servers, and get back the proof showing
> that home.arpa is insecure, and so we would not make foo.home.arpa
> exist. Of course, if recursive resolvers at sites using 'home.arpa.'
> DID NOT transparently support DNSSEC queries they would break ALL
> validation, and validating stubs wouldn't be able to resolve anything
> at all...
>

Yes, I think this is consistent with the point I am making.

Regardless, I've removed my Discuss, so I don't think there's a lot of
point in continuing to debate this.

-Ekr

>
> W
>
>
> >
> > -Ekr
> >
> >>
> >> Mark
> >>
> >> > _______________________________________________
> >> > homenet mailing list
> >> > homenet@ietf.org
> >> > https://www.ietf.org/mailman/listinfo/homenet
> >> --
> >> Mark Andrews, ISC
> >> 1 Seymour St., Dundas Valley, NSW 2117, Australia
> >> PHONE: +61 2 9871 4742                 INTERNET: marka@isc.org
> >
> >
> >
> > _______________________________________________
> > homenet mailing list
> > homenet@ietf.org
> > https://www.ietf.org/mailman/listinfo/homenet
> >
>
>
>
> --
> I don't think the execution is relevant when it was obviously a bad
> idea in the first place.
> This is like putting rabid weasels in your pants, and later expressing
> regret at having chosen those particular rabid weasels and that pair
> of pants.
>    ---maf
>