Re: [dnsext] CNAME check Re: [WGLC: draft-ietf-dnsext-dnssec-bis-updates-16]

Hi,

No hat.

> "
> When validating the CNAME, if the CNAME has not matching RRSIG and
> the validator can not decide whether the CNAME is the synthesis of
> other names such as the DNAME, this CNAME should be neglected."

In the case of DNAME, you shouldn't need to worry about the synthetic
CNAME because if you are validating you already know about DNSSEC.
Therefore, you can validate the DNAME and know that the CNAME is
synthetic.  So I don't think this text is necessary.

If you're talking about some future example, then I don't think it
will work.  Suppose that we invented RRTYPE FOO that was an xNAME.
FOO did backward compatibility by synthesizing CNAMEs for FOO-unaware
resolvers of some type (let's pretend we signalled awareness using
EDNS0).

Now, imagine a FOO-unaware validating resolver that follows the advice
you suggest.  It queries a signed zone with a FOO record.  The
resolver doesn't know about FOO.  Therefore, it doesn't know that
there could be a synthetic CNAME at that name, resulting from the FOO
record.  Therefore, it will treat the unsigned CNAME as bogus, and the
backwards compatibility doesn't happen.  

Ok, so let's suppose we went further than you did, and said any time
you see a CNAME in a signed zone that is not signed, you should assume
that the unsigned CNAME is synthetic rather than bogus.  This of
course would be a massive hole in DNSSEC: anyone who could convince
you to accept a CNAME any time could undermine your validation.
Therefore, it wouldn't be acceptable.

Is there some other scenario you can see that I haven't outlined
above?

Best,

A

-- 
Andrew Sullivan
ajs@anvilwalrusden.com

_______________________________________________
dnsext mailing list
dnsext@ietf.org
https://www.ietf.org/mailman/listinfo/dnsext