Subject: peaceful co-existance of NSEC and NSEC2

From: "Scott Rose" <[email-masked]>
Date: Mon, 24 May 2004 10:07:02 -0400

While talking about some stuff regarding the NSEC and NSEC2.   Is there a
way to proceed with DNSSEC deployment with the option of having NSEC2 coming
later - and have both systems co-exist?

I do not know the answer now, but the first option was to use different
values in the DNSKEY protocol field to indicate status of non-existance
responses in the zone.

3 - uses NSEC as in DNSSECbis docset
4 - uses NSEC2 or something else
5 - etc...

However, the problem here is interoperability with signalling unsigned
delegations.  If a NSEC-DNSSEC sec-aware resolver gets a unsigned delegation
with a NSEC2 RR (proving no DS RR exists), will the resolver could exit with
servfail (protocol error) instead of proceeding with knowledge that the zone
is unsigned.  If the resolver continues, it will see the DNSKEY RR in the
zone having a protocol field of 4 (or whatever) and declare that as invalid.
This could be bad since postive responses could be verified as normal, only
negative response are different.

This is just a possibility.  There might be others, or we could drop the
idea of co-existance of NSEC with NSEC2 (or some other option).  Just
something to keep in mind as a possibilty to allow early adopters to start
using DNSSEC (those that do not believe they have to fear zone enumeration).

Scott

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>