Subject: RE: NSEC version field (Re: NSEC2- and an Authenticated Denial M echanism Flag)

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Fri, 28 May 2004 12:41:11 -0700

> If this method is being used, then, v2 using zones will 
> appear to be unsigned 
> to v2 unaware resolvers.  There would be no way for a "V1 
> resolver" to check 
> a "V2 zone".  Signing with both known and "unknown" 
> algorithms would cause 
> the zone to just be broken.

Could we maybe as a compromise agree now that the only difference
between v1 and v2 will be that in v2 a new versioned NSEC 
record would be used?

We do not make any changes to the DNSSECbis document set at all.

We write a new short note that says that the V2 identifier is
reserved for servers that support NSEC-V, the versioned variant
of NSEC.

At that point it is possible to start deployment of DNSSEC
aware 'stuff' even though we do not have the new NSEC record
defined. That 'stuff' can also make partial use of information
from a V2 zone, even though there will be certain attacks that
are still possible.

This compromise would mean that we can go ahead and start 
deployment on the original schedule. The only difference 
would be that .uk and .de would start deployment using the 
V2 identifier and they would have to wait until we define
NSECV before they can publish any form of NXT.

Worst case this would mean that we burn a version identifier.
I think we can live with that.

We also get early experience of transitioning the system
and code has to be written with this in mind. So far I have
avoided comment on the NSEC2 proposal itself. I cannot believe 
that is going to be the final answer either.

		Phill

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Fri, 28 May 2004 16:48:41 -0700

> At 12:41 -0700 5/28/04, Hallam-Baker, Phillip wrote:
> I don't think there's been an agreement that there ought to be an 
> answer to zone enumeration.  

I think you are missing the point that I and Olafur have been making.

What the requirements may be is not the subject under discussion.
The issue under discussion is whether we have to fix DNSSECbis.

The quickest way to arrive at a consensus that we do not have to
change DNSSECbis is to convince the Europeans that deployment of
DNSSECbis as it stands will not preclude a future ammendment to 
address an issue they consider a deployment showstopper.