Subject: draft-ietf-dnsext-dnssec-intro-09: EDNS0 issue

From: Pekka Savola <[email-masked]>
Date: Sun, 7 Mar 2004 18:24:27 +0200 (EET)

[ Moderators note: Post by non-subscriber.  With the massive amount of
   spam, it is easy to miss and therefore delete relevant posts 
   by non-subsrcibers. Please fix your subscription addresses. ]

Hi,

[[ note: I'm not subscribed... ]]

I took a quick look at the DNSSEC intro document; it was in a very
good shape.

Two major comments:

 1) the document requires the use of EDNS0.  However, current EDNS0
implementations typically advertise the larger sizes than they can
handle at the IP layer, causing fragmentation.  You can argue that
this is OK as long as the result of NOT fragmenting would end up with
a worse result than as you would be without it (e.g., requiring
falling back to TCP, or whatever).

With DNSSEC, I'm not sure that this holds anymore.  It seems to me
that the best behaviour would be to avoid IP fragmentation by having
correct implementations of EDNS0, and if some data must be left out,
that it would be fetched separately, over second, third, ..., nth
query over UDP.  Shouldn't that be possible and reasonable?

 2) Security considerations lists a number of threats, but does not 
discuss whether they have been fixed or mitigated at all (e.g., 
relating to dynamic updates and signing).  It might not hurt to be a 
bit more explicit on this.  Similarly, maybe some of this text could 
be included in the DNS security analysis document as well...

editorial
---------

page 4, chapter 2, replace "RRsets forms" with "RRsets forming"

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>