Subject: Re: NSEC+ and NO

From: Jim Reid <[email-masked]>
Date: Fri, 16 Jul 2004 19:27:17 +0100

>>>>> "Roy" == Roy Arends <[email-masked]> writes:

    Roy> 873bcdba87401b485022b8dcd4190e3e NS
    Roy> 873bcdba87401b485022b8dcd4190e3e NSEC2

    Roy> They're unrelated. There is no problem. The NS record has a
    Roy> different NSEC2 associated with it. The NSEC2 is associated
    Roy> with a different owner name.

So what?

These two records have the same owner-name. Given that one of the
records is for a delegation, this has to mean complications for the
already far too ugly semantics of a zone cut. Especially wrt backwards
compatibility with the installed base. For example, what happens on an
ANY query for 873bcdba87401b485022b8dcd4190e3e.co.uk? Will it stop at
the NSEC2 in the parent or follow the delegation?

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Paul Vixie <[email-masked]>
Date: Sat, 24 Jul 2004 00:05:24 +0000

> > > There are many ways of shooting yourself in the foot. The point is that
> > > someone can't shoot you in the foot.
> >
> > Well, that's not what you said: "the DNSNR prevents you denying having
> > signed that record set."
> 
> Ben. It is very simple:

well, really, actually, not.

> If _you_ state that _you_ signed record type AAAA and record type MX for a
> given name, while not actually signing record type AAAA and record type
> MX, that would be violating the spec.

thanks for bringing the discussion back to what i think is the main point.
roy, can you explain what happens when someone hears a response that has
various permutations of this spec-violation, or when a man-in-the-middle
removes or replays (but doesn't forge or modify) any or each of these
records.

> Just as you can write an implementation that publishes a CNAME and an A
> record type for a give name. Sure you can do it. But that would be
> violating the spec.
> 
> > I would argue even more strongly against the use of
> > "non-repudiation" to describe this, since almost no-one would expect
> > it to mean what you want it to mean!
> 
> That is arrogant.

yes.  i agree with roy's use of this term.  as someone who has often been
criticised for how it was used in two other documents...

	http://sa.vix.com/~vixie/mailfrom.txt
	http://www.icann.org/committees/security/sac004.txt

...i really want to say, think carefully about the number of negatives in
the terms "non-repudiation" and the like.