Subject: Re: DNSSEC and unknown algorithms

From: David Blacka <[email-masked]>
Date: Thu, 16 Dec 2004 16:29:17 -0500

Mark Andrews wrote:

>>In my mind, and I may be missing something, if a resolver does not treat 
>>the zone as unsigned, it will be making validation decisions based on 
>>unverified data.  Which, I think, is a bad idea.  My memory is a bit 
>>hazy on the subject, but wasn't it that sort of thing that caused us to 
>>do the typecode rollover in the first place?
> 
> 
> 	The security policy may say otherwise.
> 
> 	Say you have a policy that says "Every zone beneath example.net will
> 	be signed with algorithm A" and example.net is only signed with
> 	algorithm B.
> 
> 	Treating the zone as unsigned would be a violation of that
> 	policy.

Just to clarify, in my head, everything always has an exception for 
"local policy".  But in this case, am I right in thinking that treating 
the zone as *signed* and not entirely bogus is not an option?  Or to put 
this another way, what other options besides "treat the zone as 
unsigned" or "write the whole zone off as bogus due to local policy" 
does a validator have?

-- 
David Blacka    <[email-masked]>
Sr. Engineer    VeriSign Applied Research

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Edward Lewis <[email-masked]>
Date: Mon, 20 Dec 2004 17:21:27 -0500

At 16:29 -0500 12/16/04, David Blacka wrote:

>>David Blacka wrote:
>>>My question is, why is this a SHOULD (or "should" in the first paragraph).

>>  	The security policy may say otherwise.

That and a verifier might consider this an outright resolution service failure.

(Back to where "my = David"):

>Just to clarify, in my head, everything always has an exception for "local
>policy".  But in this case, am I right in thinking that treating the zone as
>*signed* and not entirely bogus is not an option?  Or to put this another way,
>what other options besides "treat the zone as unsigned" or "write the whole
>zone off as bogus due to local policy" does a validator have?

I think the answer to the last question is "none."  (With "write off 
the zone as bogus" meaning RCODE = service failure.)

-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                                +1-571-434-5468
NeuStar

"A noble spirit embiggens the smallest man." - Jebediah Springfield