Re: [dnsext] Issues in WGLC of dnssec-bis-updates

[Mohan Parthasarathy <[e-mail]>]

On Tue, Feb 7, 2012 at 9:14 AM, Edward Lewis <[e-mail]> wrote:
> At 16:34 +0100 2/7/12, W.C.A. Wijngaards wrote:
>
>> insecure, or bogus.  Note that with the root trust anchor the
>> indeterminate state no longer occurs, since we know everything is
>> covered by that trust anchor.
>
>
> I disagree with that.
>
> The Internet that we usually think about as being the only one is what I
> call the "global public Internet".  For the global public Internet, the DNS
> in common use does have a trust anchor for it's root zone so the assertion
> holds for the majority of cases, but then again only for recursive servers
> that have the trust anchor.
>
> There are other inter-networks that use the DNS protocol.  In at least one
> of these, DNSSEC has not been deployed.
>
> And, you can stretch this to the case of a recursive server, on the global
> public Internet, that does not have the root anchor configured - and may
> have another anchor.  To such a server, validating some DNS data is
> impossible (incalculable).
>
> The protocol cannot be defined assuming one particular mode of operation.
>
Before getting to define this precisely, we should try to understand
the different cases that can occur and see whether we all agree on the
error status for the different cases.

Some RRSet needs to be validated. The RRSet was fetched with the DO bit set.

- We are able to get the RRSIGs back for the RRset. But unable to
validate completely because we are not able to get the DNSKEY RRSET or
not able to fetch the DS record. Going by 4035, this is Insecure. Two
problems here. First, it is also possible that you talked to the
DNSSEC-unaware server which does not know how to fetch the DS record.
Secondly, this could be a fake signature for which you can never
establish the trust. Do we want to declare Insecure in both these
cases ?

- We are able to get the RRSIGs back for the RRSet. But unable to
validate the signatures because it is expired. This is Bogus as per
4035.

- We are unable to get the RRSIGs back, but we got some response from
the server i.e., the main RRSet itself. Missing signatures. As per
4035, this is Bogus. But then this could be a bad CPE. Do we want to
declare this Bogus ?

We can create more examples, but it looks to me that there are only
two error cases.

1) We get some DNSSEC RRs back but can't validate. Just being able to
partially validate without tracing back to the trust anchor is equally
bad as not being able to validate the signatures.

2) We get no DNSSEC RRs back. This could be a problem in the path or
the zone is not signed. We can't tell the difference without some
extra configuration.

How does it help the application to make this more fine grained ?

-mohan


> --
> -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
> Edward Lewis
> NeuStar                    You can leave a voice message at [phone]
>
> 2012...time to reuse those 1984 calendars!
>
> _______________________________________________
> dnsext mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/dnsext
_______________________________________________
dnsext mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/dnsext