Re: [dnsext] [dane] Aiming towards some specific wording

[Mohan Parthasarathy <[e-mail]>]

On Mon, Nov 21, 2011 at 3:20 PM, Mark Andrews <[e-mail]> wrote:
>
> In message <a06240803caf071b97c5c@[10.31.200.137]>7]>, Edward Lewis writes:
>> At 8:13 +1100 11/22/11, Mark Andrews wrote:
>> >"insecure" and "indeterminate" zones are logically the same.  Dane
>> >should just treat them as !secure.
>>
>> No, they are not the same.
>>
>> Insecure means I get records indicating there's no possible trust
>> chain that can be constructed from the data to anything I have.
>>
>> Indeterminate means when I try to get records for part of the chain I
>> "time-out".  ("No servers could be reached.")
>>
>> There's a significant semantic difference between the two.  Apart
>> from the fact that you won't succeed in constructing a chain,
>> "insecure" means it is definitively impossible and "indeterminate"
>> means "not with the data at hand, at this time."  The former would be
>> data that is not protected, the latter could be declared a service
>> failure.
>>
>> Here's the definition in RFC 4035 I'm pointing to:
>>
>> 4.3.  Determining Security Status of Data
>> ...
>>     Insecure: An RRset for which the resolver knows that it has no chain
>>        of signed DNSKEY and DS RRs from any trusted starting point to the
>>        RRset.  This can occur when the target RRset lies in an unsigned
>>        zone or in a descendent of an unsigned zone.  In this case, the
>>        RRset may or may not be signed, but the resolver will not be able
>>        to verify the signature.
>> ...
>>     Indeterminate: An RRset for which the resolver is not able to
>>        determine whether the RRset should be signed, as the resolver is
>>        not able to obtain the necessary DNSSEC RRs.  This can occur when
>>        the security-aware resolver is not able to contact security-aware
>>        name servers for the relevant zones.
>
> And the difference between that and bogus is?   It got data and no
> signature so it is bogus.  If got data and bad signatures it is
> bogus.  It didn't get a response then it has no data.
>

Bogus is defined like this:

Bogus: An RRset for which the resolver believes that it ought to be
      able to establish a chain of trust but for which it is unable to
      do so, either due to signatures that for some reason fail to
      validate or due to missing data that the relevant DNSSEC RRs
      indicate should be present.  This case may indicate an attack but
      may also indicate a configuration error or some form of data
      corruption.

So, the resolver knows a priori  that there *is* a chain of trust but
it can't establish that  for the reasons that you mentioned above. .
It is different from Insecure/Indeterminate where the resolver does
not know beforehand. Within Indeterminate/Insecure, you still need
something to say that "I can't reach the servers or I am behind a
crappy CPE device" Vs. "I received an NSEC". I have been having
problems understanding what this really means and this is just my
interpretation..

-regards
mohan




>
> There are are only 3 states the data can be in.  Secure, insecure and bogus.
>
> --
> Mark Andrews, ISC
> 1 Seymour St., Dundas Valley, NSW 2117, Australia
> PHONE: [phone]                 INTERNET: [e-mail]
> _______________________________________________
> dnsext mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/dnsext
>
_______________________________________________
dnsext mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/dnsext