Subject: Re: proposed definition for the NXT

From: Paul Vixie <[email-masked]>
Date: Tue, 06 May 2003 14:24:41 +0000

> I'm proposing this for the NXT in the DNSSECbis document...
> 
>    After properly validating the NXT's authenticity:
> 
>    If the NXT-position bit is 1, then the NXT is processed as per RFC 2535
>    or the DS RR (I don't recall any difference).
> 
>    If the bit is 0, then the verifier treats the zone as unsigned,
>    ergo, all the subzones are unsigned.  (Yeah, yeah, secure entry
>    points, yadda, yadda.)

at first glance, i like this approach.

>    (See note 1 below.)
...
> Note 1 - Yes, any '0' bit in the NXT will make the resolver see the whole
> zone as unsigned - for the duration of the query at least, at most the ttl
> of the NXT it is looking at.  The burden is not on the resolver to seek out
> all the NXT's and look for '0' bits, but only if the query stumbles on it.
> Treating the zone as unsigned means ignoring any DS records, KEY records,
> SIG records, NXT records, etc. By tainting the whole zone you "punish" the
> operator for doing this on the large scale, if that is your desire.  I
> think just treating spans of the zone as unsigned would be an over
> complication and too much like the current opt-in.  Perhaps we should
> always require a server to load only zones that have one kind of NXT - with
> the 1 or with the 0, and no combinations.  This will make it easier to
> decide of a zone is doing funny stuff.

since it's unenforceable, let's not specify that.  that is, your rule about
interpreting a "0" bit is the same thing, and would have to be done no matter
what requirements were stated for zone operators.  so let's just note that
so that zone operators can understand that the significance of a single "0"
bit is the same, to what you're calling 2535-style (but is really DS-style)
validators, as if all NXT.maskbit(NXT)'s in the zone were zero.  if a zone
operator wants to mix their 0's and 1's in spite of this notation, then it's
possible they'll have a reason they consider good and sufficient.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Paul Vixie <[email-masked]>
Date: Tue, 27 May 2003 17:02:51 +0000

> I was told that I could label this question Q-10...;)
> 
> Any comments on this proposal?  (It's been posted a few times.) Sooner or
> later this will be cast into MUST/SHOULD language and submitted to the
> dnssec-editors, based on feedback.

i think it is a good proposal and should be added.