Subject: Re: Q-21: Can NSEC records in the cache be re-used?

From: David Blacka <[email-masked]>
Date: Wed, 19 Nov 2003 13:32:51 -0500

On Wednesday 19 November 2003 09:44 am, Matt Larson wrote:
> Q-21: Can NSEC records in the cache be re-used?
> 
> Section 3.2, second paragraph, of
> draft-ietf-dnsext-dnssec-protocol-03.txt refers to the re-use of NSEC
> records from the cache:
> 
>   A security-aware recursive name server MUST NOT use NSEC RRs from
>   one negative response to synthesize a response for a different
>   query.

I'm not even sure this sentence accomplishes what was originally intended.  
What about NSEC RRs that were part of a positive response (i.e., a 
referral)?

> Some reviewers have suggested that this language is overly
> restrictive.  The editors propose this additional text immediately
> following the above sentence to allow for a specific case of re-use:

While this sentence may be too restrictive, the previous sentence in that 
paragraph certainly is:

   A security-aware recursive name server MUST NOT attempt to answer a
   query by piecing together cached data it received in response to
   previous queries that requested different QNAMEs, QTYPEs, or
   QCLASSes.

>   A security-aware recursive name server MAY use an NSEC RR from a
>   previous response to generate a NODATA response to a current query,
>   provided that the QNAME and QCLASS of the current query match the
>   owner name and class, respectively, of the cached NSEC RR.
> 
> Does the working group have any objection to this added text?

One of my issues is that I (and perhaps the WG as a whole) don't really 
understand the issue well enough to judge.

Ultimately, what I would like to see is language describing what the 
caching nameserver MUST NOT do with cached NSEC records, and have that 
MUST NOT be defined as narrowly as possible.  Additonally, I would like to 
see language describing WHY caches MUST NOT use NSEC records in that 
fashion.

But I think the first step is making sure we understand the problem in the 
first place.

-- 
David Blacka    <[email-masked]> 
Sr. Engineer    Verisign Applied Research

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: "Olaf M. Kolkman" <[email-masked]>
Date: Thu, 27 Nov 2003 10:18:13 +0100

Q21: Caching and reuse of NSEC RRs

      Default action, based on sense of the room at IETF58, is to
      change the text not to strongly prohibit any reuse of cached
      NSEC RRs, but to allow, and not encourage, (MAY language) reuse
      to synthesize negative answers for which QNAME, QLASS has an
      NSEC RR of same ONAME and CLASS in cache that proves the non
      existance of QTYPE.

      If there is no further prohibitive objections by December 8 this 
      will be taken as consensus of the working group.

-- Olaf
   DNSEXT co-chair
---------------------------------| Olaf M. Kolkman
---------------------------------| RIPE NCC