Subject: Re: Wildcard NS and DNSSEC

From: [email-masked]
Date: Wed, 29 Oct 2003 10:52:18 +1100

> [On 27 Oct, @15:16, Samuel wrote in "Re: Wildcard NS and DNSSEC ..."]
> > > Additionally, you might be able to see that part of the standard
> > > wildcard validation is missing: proof that (at least) the wildcard
> > > actually exists.
> > 
> > Put simply, the parent has no RRSIG on the NS set, and the RRSIG is an
> > integral part of a wildcard proof.
> > 
> > > I suppose that it might be possible to handle this by adding another
> > > NSEC record for the wildcard, which may solve some nagging security
> > > issues, but would be a pretty odd special case.
> > 
> > Ick.  Let's just forbid it and move along.  If someone really wants to
> 
> I'm in favor of doing that also,
> 
> grtz Miek

  As am I.

> 
> --
> to unsubscribe send a message to [email-masked] with
> the word 'unsubscribe' in a single line as the message text body.
> archive: <http://ops.ietf.org/lists/namedroppers/>
--
Mark Andrews, Internet Software Consortium
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Rob Austein <[email-masked]>
Date: Tue, 28 Oct 2003 20:28:22 -0500

just forbid wildcard ns and move along, aye.

---

From: masataka ohta <[email-masked]>
Date: Thu, 30 Oct 2003 13:13:39 +0900

Rob Austein;

> just forbid wildcard ns and move along, aye.

I do love simple approaches.

However, in this case, the complexity is not in wildcard but
in DNSSEC.

So, the proper question is

	do we need DNSSEC?

and the reality is that we don't.

Just discard DNSSEC and move along.

						Masataka Ohta