Subject: Dumb question about NSEC3 and opt-in

From: Roy Badami <[email-masked]>
Date: Tue, 8 Mar 2005 22:48:04 +0000

Having only skimmed the draft, and the thread of comments on it, I may
have missed something, so apologies if this is a dumb question.

Is it the case that, with opt-in (authoritive only bit set), that:

1. When the nameserver responds with an insecure delegation, it MUST
   still prove it to be insecure, by including the covering NSEC3
   record that proves non-existence of a DS record?

2. When the nameserver responds with NXDOMAIN, it MUST still prove the
   absence of authoritative data (even though it can't prove the
   absence of the domain) by including the covering NSEC3 record.

3. That a security-aware resolver MUST veryify (1) and (2) above and
   return 'bogus' if they're not satisfied?

I'm assuming/hopeing the answer is 'yes' in all three cases...

   -roy

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Roy Arends <[email-masked]>
Date: Wed, 9 Mar 2005 03:32:17 +0100 (CET)

>    record that proves non-existence of a DS record?

Yes.

>    absence of the domain) by including the covering NSEC3 record.

Yes.

>    return 'bogus' if they're not satisfied?

Yes.

> I'm assuming/hopeing the answer is 'yes' in all three cases...

Correct :)

Roy

---

From: Roy Badami <[email-masked]>
Date: Wed, 9 Mar 2005 10:32:46 +0000

>> I'm assuming/hopeing the answer is 'yes' in all three cases...

    Roy> Correct :)

Thanks...