Re: [dnsext] Issues in WGLC of dnssec-bis-updates

In message <4F3232B6.3060505@nlnetlabs.nl>, "W.C.A. Wijngaards" writes:
> No, the application just wants all bogus data to be removed.  Data that
> is secure and data that is not DNSSEC signed is what it wants.  Because
> of the chain-of-trust the validator knows which parts of the space below
> a trust anchor is signed (and must have DNSSEC available) and which part
> is unsigned.

More correctly it knows if it should be able to get a signed answer
with signatures it is capable of verifying or not.  A zone can be
insecure, as far as the validator is concerned, even if there are
DS records in the parent zone and the validator treats the parent
zone as secure.

> This property could be the cause that made insecure and
> indeterminate terms exist, as indeterminate is not really processed but
> simply the absence of a covering trust anchor, just like in the case
> where you had no trust anchors at all.  But then insecure needs
> processing: you have to validate the chain of trust from the trust
> anchor to the insecure-delegation point, and only then can you conclude
> that the data is insecure.

No, you can conclude that you don't expect to be able to validate
it.  The break point may or may not be at a insecure delegation (no
DS records in parent zone).

In reality the first step of validation is determining if there is
a trust anchor that is could potentially result in the data being
declared secure.  From the application's perspective there is no
difference if the data came from a zone that was not under a
configured trust anchor or from a zone to which there is not a trust
chain supported by the validator.

> This is something internal to the DNSSEC
> validator, and not particularly impressive to the application, that
> likely just wants to know if the data was DNSSEC-signed (if so: secure
> or bogus) or if the data was not DNSSEC-signed (as determined with the
> configured set of trust anchors).

No, it want to know if it is secure or insecure (insecure data can still
be signed data).

Mark
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: marka@isc.org
_______________________________________________
dnsext mailing list
dnsext@ietf.org
https://www.ietf.org/mailman/listinfo/dnsext