Re: [dnsext] does making names the same NEED protocol changes at all?

[Brian Dickson <[e-mail]>]

On Fri, Feb 25, 2011 at 2:51 PM, Nicholas Weaver
<[e-mail]> wrote:
>
> On Feb 25, 2011, at 10:48 AM, Andrew Sullivan wrote:
>
>> No hat
>>
>> On Fri, Feb 25, 2011 at 10:34:22AM -0800, Nicholas Weaver wrote:
>>>
>>> There is NOTHING which prevents such slaves from forwarding the dynamically signed requests to the master and caching the results and forwarding it on.
>>
>> Except, of course, that it would be insane, since that would turn the
>> master into a potential single point of failure for any lookup in the
>> zone.  A significant reason for the success of the DNS is its loose
>> consistency and resulting resilience to failure.  Any scheme which
>> replaces that with a single server is doomed to failure.
>
> It is ONLY a point of failure for NeW MiXED CasINGs which appear.  Old ones remain cached.
>
> And unlike other schemes, does NOT require any changes to resolvers.  Any proposal which requires changes to resolvers rather than just authorities which want to support non-ascii mixed case is IMO, a non-starter.

I think it is useful to be precise in scoping exactly what changes
we're talking about.

Specifically, when it comes to DNSSEC and signatures, there are
several individual cases, whose deployed implementation may or may not
require changes, depending on the specific proposal(s):
- validating iterative resolvers
- non-validating, DNSSEC-aware iterative resolvers (is there such a thing?)
- DNSSEC-unaware iterative resolvers
- validating stub resolvers
- non-validating, DNSSEC-aware stub resolvers (CD=1) (who talk to
validating iterative resolvers)
- DNSSEC-unaware resolvers (who may be talking to any of the above
sorts of iterative resolvers)

The tails on each of these is of (drastically, IMHO) different lengths.

And, the behavior in the cases of unmodified instances of the above,
in the face of modified authority server answers (new RRtypes, new
DNSSEC RRTYPEs, new DNSSEC validation logic), may differ too.
(Bogus vs Insecure is a huge difference.)

Let's hold off on passing judgement until:
- the requirements doc is cleaned up and accepted (or not)
- proposals are available for evaluation, and/or have been read and
commented on.

(ObContent - my somewhat stale DS2 draft is on-topic, I hope, and
could use some reviewers and feedback, even if it is not yet time to
propose adopting it for WG consideration. Applies only to validating
resolvers (of both kinds) and authority servers who want to use it,
and is benign/fail-safe-ish, with "insecure" rather than "bogus" when
the validator does not understand it.)

Brian
_______________________________________________
dnsext mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/dnsext