Subject: Re: DNSSECbis Q-2: degradation attack

From: Paul Vixie <[email-masked]>
Date: Fri, 12 Sep 2003 17:26:17 +0000

bill wrote:

> ... w/ DNSSEC, individual rrs are bound into "atomic" rrsets. ...

that's not a dnssec thing, it's a basic fact of dns.  the fact that the
protocol doesn't express rrsets as atomic is a weakness in the design
(in that it wastes space and permits erroneous carriage).  rrsets cannot
be validly sent, cached, or used other than in their authoritative entirety.

paul

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: "D. J. Bernstein" <[email-masked]>
Date: 13 Sep 2003 04:01:53 -0000

Paul Vixie writes:
> rrsets cannot be validly sent, cached, or used other than in their
> authoritative entirety.

Last I checked, BIND truncated UDP packets before the first record that
passes 512 bytes, even if that's in the middle of a record set.

I simply truncate before all records. Clients shouldn't be trying to use
records from a truncated packet anyway; I don't know why BIND bothers to
send them.

---D. J. Bernstein, Associate Professor, Department of Mathematics,
Statistics, and Computer Science, University of Illinois at Chicago

---

From: Sam Weiler <[email-masked]>
Date: Sat, 13 Sep 2003 01:21:23 -0400 (EDT)

> ... you seem to be intimating that if part of an rrset is
> unknown/opaque to me as a resolver, I have the obligation to split
> the rrset back into indvidual rrs and toss those bits I can't parse
> and then (possibly) reassemble the rrset with the bits I can parse?
> is that -really- what you are suggesting?

Not at all.

I don't like this existence language, but MCR made it sound so
reasonable.  :)

<gentle persuading device activated>

Instead, how about "they don't exist for me for the purposes of DNSSEC
validation"?  If I cache the RRset, I must cache the whole thing.
Same thing for answering queries.

Or perhaps: I assign no special meaning to them -- where I might have
seen an unsupported RRSIG and assumed 'oh well, the record is signed
but I'm lame and don't grok the algorithm; maybe I should tuck my tail
between my legs, whimper a little, and give a soft failure since I'm
so incapable', I instead say 'there's no RRSIG here and because
there's a supported DS for the zone, I expected one, so I'll give a
hard failure.  Bite me.'

Again, the RRset is atomic.

-- Sam