Subject: Re: DNSSEC wildcard optimization.

From: Bob Halley <[email-masked]>
Date: 23 Oct 2002 20:30:52 -0700

Roy Arends <[email-masked]> writes:

> > What is unclear?
> 
> It is not 1034/5 that is unclear, though the 2535 description of handling
> secure wildcards is unclear.  Last time I looked a widely known
> implementation of a DNS server did not get secure wildcards right.

When I was working on BIND 9, we didn't implement them not because we
didn't understand the spec or because the spec was deficient, but
because we didn't know how to do an efficient algorithm in the
presense of bitstring labels, and didn't have the schedule time to
figure that out and cope with the extra validator complexity that
wildcards cause.  Bitstring labels are gone, and so the "obvious"
wildcard proof generation algorithms are now fine.

We have implemented the generation and validation of DNSSEC wildcard
proof in Nominum's proprietary nameservers.  Wildcards have often been
a thorn in my side as an implementor; we implmented them because
people use them to solve real problems.  Adding similar functionality
to BIND 9 is just programming; it's not a standards issue.

> You tell me what is unclear.

I'm not having a problem with the RFCs; it's not my place to guess
what other people find unclear or deficient.

> Since non-implemented secure wildcards is currently the default, how is it
> that not implementing secure wildcards will delay or discourage deployment

Because people *use* wildcards for legimate purposes.  Telling someone
"You can secure your zone, but you'll have to change the way you
handle mail because the secure DNS does not support wildcards." is
going to present real world operational challenges to people who might
otherwise convert.

I'm saying: implement wildcards everywhere, stop messing with the specs,
and let things deploy.

/Bob

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: David Conrad <[email-masked]>
Date: Wed, 23 Oct 2002 21:51:39 -0700

> implementation of a DNS server did not get secure wildcards right.

There is a difference between getting something wrong because of vagueness
with specs and not implementing it.  For various reasons, we did not have
time to implement secure wildcards in BIND.  It wasn't a question of not
understanding what to implement.

> You tell me what is unclear.

I believe Olafur has asserted (and others have indicated agreement) that the
specification is unclear, not Bob.  Those folks should be the ones to
indicate what they found to be unclear.

> Since non-implemented secure wildcards is currently the default,

In one implementation.

> how is it

It is yet again screwing around with the DNSSEC specifications.  How does
anyone expect any significant deployment or even implementation of
specifications if people continue to screw around with those specs,
particularly in non-backwards compatible ways?

Can we please stop?  I'd like to see DNSSEC deployed in my lifetime.

> ? Why isn't it implemented by now ?

It has been, just not in BIND.

Rgds,
-drc