Subject: DNSSECbis Q-11: KEY RRs at delegation points

From: "Scott Rose" <[email-masked]>
Date: Wed, 28 May 2003 14:25:58 -0400

This was a sidebar topic in Q-8:  non-zone KEY RRs at the apex.

Q:  Should KEY RRs (any) be allowed at delegation points?

Discussion:
There isn't a formal rule already in the documents prior to the DNSSECbis
re-write.  The KEY@parent idea stated that the delegating zone key would
appear at a delegating parent in order to set up the chain of
authentication.

Now with the DS RR, the zone KEY remains in the delegated child zone.  In
the latest version of the protocol draft (-01), this is further restricted
by saying that KEY RRs MUST NOT appear at delegation points.  The topic is
whether this restriction is necessary.

If the KEY RR is to be considered glue RRs like the other RRs at the
delegation point, then it is not signed, and cannot be validated when
received with the delegation.  Unless it is to be considered authoritative
for the delegating zone, like the DS RR.

However, there is no harm to the protocol by allowing it, is there?

Scott

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: [email-masked]
Date: Fri, 30 May 2003 08:36:46 +1000

> At 10:59 -0700 5/29/03, Andreas Gustafsson wrote:
> >Perhaps it would be helpful to re-cast Q-11 in the form "Should KEY
> >records at delegation points in parent zones be treated any different
> >from other random (non-NS, non-DS) record types?", and settle the
> >general question of what to do with random stuff at delegation points
> >outside the context of DNSSEC.
> 
> Yeah.
> 
> I was under the impression that one implementation, BIND, refused to 
> load out of zone glue - hence I interpret more tightly the words in 
> 1034 - the ones I quoted - as saying only address glue is acceptable.
> 
> -- 
> -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
> Edward Lewis                                            +1-703-227-9854
> ARIN Research Engineer
> 
> Digital cameras are to film cameras as Etch-A-Sketches are to canvases.
> 
> --

	Out of zone glue is a record with a ownername that is not below
	the name of the zone.

	BIND 8 will reject non-glue below the zone as it has no way to
	store it.

	BIND 9 will accept non-glue below the zone.

	BIND 9 masters will reject out of zone glue.
	BIND 9 slaves will accept (but not return) out of zone glue
	(next release).
--
Mark Andrews, Internet Software Consortium
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]