Re: [v6ops] Last Call: <draft-ietf-v6ops-v6-aaaa-whitelisting-implications-08.txt> (Considerations for Transitioning Content to IPv6) to Informational RFC

One can whitelist with DNSSEC at the source.  It just requires
having two nsec/nsec3 chains if the zone is signed.  One with AAAA
records in the bit map field and one without.  There are a number
of ways to implement this.  It's just a matter of returning consistent
answers.

In named this can be done with views.

	view "aaaa" {
		match-clients {
			key aaaa; !key noaaaa;
			whitelist;
		};
		zone "example.com" {
			type master;
			file "aaaa/example.com.signed";
		};
	};

	view "noaaaa" {
		match-clients {
			key noaaaa; !key aaaa;
			!whitelist; any;
		};
		zone "example.com" {
			type master;
			file "noaaaa/example.com.signed";
		};
	};

If you want to whitelist in the resolver, then DO=1 + signed AAAA
disables whitelisting.  There is no point when the client can detect
that it is happening.  This is what we did for filter-aaaa in named.

In message <20120220.170216.446120856.he@uninett.no>, Havard Eidnes writes:
> > The IESG has already approved this drat for publication.  However, I
> > think that your comment is significant if you can make a case that
> > the DNS information returned to the user is less trustworthy than it
> > would have been had the authoritative DNS not been practicing
> > whitelisiting.  Can you make this case?
> 
> "Less trustworthy" would be an imprecise euphemistic term to use in
> this case.  Instead, the returned data would fail cryptographic
> validation as performed by DNSSEC, and would therefore be discarded as
> invalid ("incorrect") by a DNSSEC-validating resolver.
> 
> Therefore, it would seem to me that you can either do AAAA
> whitelisting or DNSSEC, but not successfully do both.
> 
> Regards,
> 
> - H=E5vard
> _______________________________________________
> v6ops mailing list
> v6ops@ietf.org
> https://www.ietf.org/mailman/listinfo/v6ops
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: marka@isc.org