Subject: Re: question about dnssec-protocol-04

From: Rob Austein <[email-masked]>
Date: Mon, 22 Dec 2003 15:17:08 -0500

At Mon, 22 Dec 2003 14:45:36 -0500, David Blacka wrote:
> 
> draft-ietf-dnsext-dnssec-protocol-04, section 2.3 has the following 
> paragraph:
> 
>    An NSEC record (and its associated RRSIG RRset) MUST NOT be the only
>    RRsets at any particular owner name.  That is, the signing process
>    MUST NOT create (or RRSIG) RRs for owner names nodes which were not
>    the owner name of any RRset before the zone was signed.
> 
> [There is an editing nit here, too: s/MUST NOT create (or/MUST NOT create 
> NSEC (or/, I think.]
> 
> I feel sure that I have just forgotten the discussion about this, but why 
> does this restriction exist?  What harm would NSEC records of this sort 
> cause?
> 
> It is true that I cannot think of any useful reason to do this, but 
> forbidding such NSEC records should have some real problem associated with 
> it.

Empty non-terminals.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: [email-masked]
Date: Tue, 23 Dec 2003 07:41:09 +1100

> does this restriction exist?  What harm would NSEC records of this sort 

	A signed zone should return the same answers as a unsigned
	zone modulo DNSSEC records.
 
> forbidding such NSEC records should have some real problem associated with 

	Without the rule it also means that a UPDATE client needs
	to know to delete NSEC when the last regular record is
	deleted.  This introduces race conditions between the client
	and the server which don't exist if the server is left to
	manage the creation and deletion of NSEC.
 
> -- 
> David Blacka    <[email-masked]> 
> Sr. Engineer    Verisign Applied Research
> 
> 
> --
--
Mark Andrews, Internet Software Consortium
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

---

From: David Blacka <[email-masked]>
Date: Mon, 22 Dec 2003 22:19:04 -0500

On Monday 22 December 2003 3:17 pm, Rob Austein wrote:

> > forbidding such NSEC records should have some real problem associated
> > with it.
>
> Empty non-terminals.

Huh?

I know what empty non-terminals are, but I have know idea what you are talking 
about.

---

From: Rob Austein <[email-masked]>
Date: Mon, 22 Dec 2003 22:59:41 -0500

> I know what empty non-terminals are, but I have know idea what you are talking 

The restriction is there to make sure that signer and verifier agree
on whether or not empty non-terminal nodes are supposed to have signed
NSEC RRs.

---

From: [email-masked]
Date: Tue, 23 Dec 2003 17:29:01 +0100 (CET)

> does this restriction exist?  What harm would NSEC records of this sort

The current thinking is that empty non-terminals in the non-dnssec realm
become non-empty non-terminals when one starts to associate (dnssec)
records with them. That introduces different meaning from different
perspectives (secure and non-secure) over a single dataset. I'm not happy
with the difference. I don't know the impact of that difference, though
its likely to be small, even benign (but it _is_ a difference).

I'd rather not allow it so we don't have to deal with weird cornercases in
the future.

> forbidding such NSEC records should have some real problem associated with

Allowing such NSEC records should have some useful reason associated with
it, is the way I think.

Roy.