Subject: Q-21: Can NSEC records in the cache be re-used?

From: Matt Larson <[email-masked]>
Date: Wed, 19 Nov 2003 09:44:32 -0500

Q-21: Can NSEC records in the cache be re-used?

Section 3.2, second paragraph, of
draft-ietf-dnsext-dnssec-protocol-03.txt refers to the re-use of NSEC
records from the cache:

  A security-aware recursive name server MUST NOT use NSEC RRs from
  one negative response to synthesize a response for a different
  query.

Some reviewers have suggested that this language is overly
restrictive.  The editors propose this additional text immediately
following the above sentence to allow for a specific case of re-use:

  A security-aware recursive name server MAY use an NSEC RR from a
  previous response to generate a NODATA response to a current query,
  provided that the QNAME and QCLASS of the current query match the
  owner name and class, respectively, of the cached NSEC RR.

Does the working group have any objection to this added text?

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Paul Vixie <[email-masked]>
Date: Wed, 19 Nov 2003 17:30:50 +0000

> ...

i think so but i'm not sure.  dnssec pseudo-rr's are really just metadata
and i'm uncomfortable with anything that unbinds them from their carrier
primary data.  if the above wording makes dnssec metadata atomic with
respect to its the data it pertains to then i have no objection.  but, i
can't tell from here.

---

From: "Scott Rose" <[email-masked]>
Date: Wed, 19 Nov 2003 13:07:36 -0500

----- Original Message ----- 
From: "Paul Vixie" <[email-masked]>
> respect to its the data it pertains to then i have no objection.  but, i

another thing to think about is if it is safe to use cached data to form a
negative reply out of RRs from a previous negative reply.

off topic for Q21 (re: dnssec rrs):
In a way, yes.  NSEC RRs could be queried for the information they do
contain, since they contain more non-security information than RRSIGs.  I
can imagine a scenario where a application may want to issue NSEC queries
instead of "name.  IN  ANY"  queries, for example.  An RRSIG isn't that
informative without the RR set it covers.  A NSEC RR contains some
information that could be used in a non-DNSSEC manner.

---

From: Paul Vixie <[email-masked]>
Date: Wed, 19 Nov 2003 22:18:57 +0000

> I disagree that DNSKEY should be treated as metadata.  There are times when
> an explicit query for a DNSKEY is required and there is no ambiguity about
> subtyping/query name/whatever.   Explicit queries for DNSKEY and DS are
> needed in my view.

ok by me.