Re: [keyassure] Asserting DANE exclusivity for an entire domain

[Zack Weinberg <[e-mail]>]

On Wed, Feb 9, 2011 at 9:34 AM, Paul Wouters <[e-mail]> wrote:
> On Wed, 9 Feb 2011, Martin Rex wrote:
>
>>>>> I agree with this, but the question is how do you present an empty
>>>>> list.
>>>>
>>>> What exactly would you want to convey with an empty list?
>>>>
>>>>  "I won't respond to TLS, so don't even bother trying"
>>>
>>> More precisely, "there is no TLS service associated with this DNS
>>> name/transport/port".  Therefore, general-purpose clients that refer to
>>> TLS services by DNS name/transport/port will not be able to make a
>>> connection.
>
> What's wrong with an NSEC record for the TLSA/HASTLS record saying that?

NSEC for any new DNS record MUST mean "behave as you would have prior
to the invention of the new DNS record".  To do otherwise would
require a flag day for the entire Internet and therefore jeopardize
not only the transition to whatever new DNS record is suggested, but
the transition to DNSSEC itself.

(However, a "bogus" DNSSEC validation state for any lookup at all can
and should be treated as a MUST-refuse-to-proceed condition.)

zw