Subject: Re: [dnsext] Checking RRSIG RR validity

From: "W.C.A. Wijngaards" <[email-masked]>
Date: Sat, 01 Jan 2011 23:15:14 +0100

Hi Mohan or Sean and George,

On 12/31/2010 08:36 PM, Sean Wells or Mohan wrote:
> On Fri, Dec 31, 2010 at 9:55 AM, George Barwood wrote:
>> I agree the standard is not explicit here. These are my thoughts

That looks ok to me.

>> Unfortunately a validating resolver does not know the zone in a 
>> secure way, so it's unclear how this is to be implemented.

Yes it may know more, because it may know where the information was
fetched from (it is also a full resolver) and thus that the signer name
must be equal or lower to that last delegation point.

If you really want, it is possible to securely determine the zone, think
nodata DS answers.

> That is exactly my issue.
> Perhaps, it would be good to clarify this in the
> Clarifications document ? (assuming there is consensus).

The checks from George look good to me.  However I do not think that
needs to be RFC-ed, because, I do not want to force 'bottom-up' or
'top-down' validation.

Also, I believe those RR type checks are a bit over-the-top.  Although
it means the zone is badly configured, you can leniently let it pass,
since it was signed by the owner.  (And Happy New Year for Ed :-) ).

Best regards,
   Wouter
_______________________________________________
dnsext mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dnsext