Subject: DNSSEC protocol: attempting to retrieve SIGs

From: "Olaf M. Kolkman" <[email-masked]>
Date: Thu, 17 Apr 2003 14:41:13 +0200

dnssec protocol draft.

A somewhat detailed nit.

Section 4, page 21 first but last paragraph:

  a security aware resolver MUST attempt to retrieve missing DS, KEY,
  or SIG RRs.

Seems to be inconsistent with section 3 that says that:

  SIG RRs which can be used to authenticate the data MUST be included.
  (more detailed in the subsections)

Based on the "MUST" in section 3 I would say if the SIG is not
included in a response packet (while it is being expected) a
implementation can just drop it and concern it bad.

Section 4 could read:
  a security aware resolver MUST attempt to retrieve missing DS and KEYs,
(drop the SIGs from that).

On the other hand it could be that one of the set of authoritative
servers does not properly do the dnssec processing (is buggy or not
DNSSEC aware). In that case such server should be marked as lame and
the query (not for the SIG but the original query, I'd say) should be
done against another server. If that is the expected behavior I think
some explanatory text is needed.

--Olaf

--------------------------------------------| Olaf M. Kolkman
                                            | www.ripe.net/disi

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>