Subject: Re: [homenet] Eric Rescorla's Discuss on draft-ietf-homenet-dot-13: (with DISCUSS)

From: Eric Rescorla <[email-masked]>
Date: Fri, 1 Sep 2017 08:41:33 -0600

On Thu, Aug 31, 2017 at 8:39 PM, Mark Andrews <[email-masked]> wrote:

>
> In message <150413520708.16860.14531912464478386147.
> [email-masked]>,
> Eric Rescorla writes:
> > Eric Rescorla has entered the following ballot position for
> > draft-ietf-homenet-dot-13: Discuss
> >
> > When responding, please keep the subject line intact and reply to all
> > email addresses included in the To and CC lines. (Feel free to cut this
> > introductory paragraph, however.)
> >
> >
> > Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.
> html
> > for more information about IESG DISCUSS and COMMENT positions.
> >
> >
> > The document, along with other ballot positions, can be found here:
> > https://datatracker.ietf.org/doc/draft-ietf-homenet-dot/
> >
> >
> >
> > ----------------------------------------------------------------------
> > DISCUSS:
> > ----------------------------------------------------------------------
> >
> >        A.  Recursive resolvers at sites using 'home.arpa.'  MUST
> >            transparently support DNSSEC queries: queries for DNSSEC
> >            records and queries with the DO bit set ([RFC4035] section
> >            3.2.1).  While validation is not required, it is strongly
> >            encouraged: a caching recursive resolver that does not
> >            validate answers that can be validated may cache invalid
> >            data.  This in turn will prevent validating stub resolvers
> >            from successfully validating answers.
> >
> > I don't understand the rationale for this requirement. As I understand it
> > from this document, stuff ending in home.arpa cannot be DNSSEC validated,
> > so what's it the business of this document to levy the requirement on
> > sites which support home.arpa that they do anything with DNSSEC at all.
>
> Wrong the responses can be validated.  The output of the validation
> step is one of secure, insecure, or bogus.  With the exception of
> home.arpa/DS and without private trust anchors being installed the
> output of that validation should be insecure for all answers from
> home.arpa.  home.arpa/DS should validate as secure NODATA.
>
> In particular validation of the home.arpa/DS is important as it
> prevents the cache being poisoned with answers which prevent the
> stub proving that the home.arpa is supposed to exist and that it
> doesn't have a chain of trust from the root.
>

I don't see how this is different from any other kind of resolution.

-Ekr

> Mark
>
> > _______________________________________________
> > homenet mailing list
> > [email-masked]
> > https://www.ietf.org/mailman/listinfo/homenet
> --
> Mark Andrews, ISC
> 1 Seymour St., Dundas Valley, NSW 2117, Australia
> PHONE: +61 2 9871 4742                 INTERNET: [email-masked]
>

---

From: Warren Kumari <[email-masked]>
Date: Sat, 2 Sep 2017 20:38:10 -0400

On Fri, Sep 1, 2017 at 10:41 AM, Eric Rescorla <[email-masked]> wrote:
>> In message
>> <[email-masked]>,
>> Eric Rescorla writes:
>> > Please refer to
>> > https://www.ietf.org/iesg/statement/discuss-criteria.html

Jumpin' in the middle here.

The root proves that .arpa exists. .arpa proves that home.arpa exists,
but, as there is no DS record, it also proves that names under
home.arpa are insecure, and so we can create foo.home.arpa,
bar.home.arpa, etc.

If recursive resolvers at sites using 'home.arpa.'  DID NOT
transparently support DNSSEC queries, then validating stubs would not
be able to query the .arpa servers, and get back the proof showing
that home.arpa is insecure, and so we would not make foo.home.arpa
exist. Of course, if recursive resolvers at sites using 'home.arpa.'
DID NOT transparently support DNSSEC queries they would break ALL
validation, and validating stubs wouldn't be able to resolve anything
at all...

W

-- 
I don't think the execution is relevant when it was obviously a bad
idea in the first place.
This is like putting rabid weasels in your pants, and later expressing
regret at having chosen those particular rabid weasels and that pair
of pants.
   ---maf

---

From: Eric Rescorla <[email-masked]>
Date: Sat, 2 Sep 2017 20:05:31 -0600

> >> > https://datatracker.ietf.org/doc/draft-ietf-homenet-dot/

Yes, I think this is consistent with the point I am making.

Regardless, I've removed my Discuss, so I don't think there's a lot of
point in continuing to debate this.

-Ekr