Subject: Re: [dnsext] Fwd: New Version Notification for draft-dempsky-dnscurve-00

From: Paul Wouters <[email-masked]>
Date: Thu, 3 Sep 2009 16:28:31 -0400 (EDT)

On Thu, 3 Sep 2009, George Barwood wrote:

>>> The TTL should be at least the TTL of the address record(s), and
>>> caches should not discard a DPCK record before the corresponding address record.
>>
>> That seems like a bad idea and very contrary to normal DNS operations. If they
>> really cannot be cached individually, then the protocol should not send them
>> as individual items with individual TTL's.
>
> That's DNS for you. Nameservers that cache records until TTL expiry don't
> have to take any special action. It's quite straight-forward.

But you wouldn't need/use the glue. It would be verified later at the child where
the authoritative data for that A record really exists? Now if you have multiple
domains with a DPCK record going to the same nameserver IP, the A record and the
DPCK record TTL's would not be "in sync" as you state is required.

> Ok, I will give an example. For simplicity I will assume each domain has
> just 1 name server, and each name server has just 1 address ( A record ).

Thanks. That did clarify things.

Paul

---

From: "George Barwood" <[email-masked]>
Date: Fri, 4 Sep 2009 06:17:06 +0100

----- Original Message ----- 
From: "Paul Wouters" <[email-masked]>
To: "George Barwood" <[email-masked]>
Cc: <[email-masked]>
Sent: Thursday, September 03, 2009 9:28 PM
Subject: Re: [dnsext] Fwd: New Version Notification for draft-dempsky-dnscurve-00

> DPCK record TTL's would not be "in sync" as you state is required.

No, because it's the LHS of the A record that counts, not the RHS. Those are distinct records.

In my example

A.NS.BIG-REG.NET A  5.6.7.8
A.NS.BIG-REG.NET DCPK WBJ51WD27KLSX63WV0PR2J35R4GP7R06RK3XHULBZYPRK2T5U6C

needs to be thought of as a single RRset, with integrity / indivisibility.

The zone BIG-REG.NET has a copy, and the parent zone also has a glue copy,
since the name server is in-zone.

If there was a AAAA record, that would also form part of the "logical" RRset. 
In a clean design you would have a single extensible resource record that could
store any address or transport information, but that's another issue. It might look 
like

A.NS.BIG-REG.NET TRANSPORT( A 5.6.7.8, AAAA 8::9::1, DCPK WBJ....U6C )

or somesuch. But that's another issue, and one I certainly don't want to get into!

George

---

From: Matthew Dempsky <[email-masked]>
Date: Fri, 4 Sep 2009 11:38:46 -0700

On Thu, Sep 3, 2009 at 8:21 AM, George
Barwood<[email-masked]> wrote:
> When responding to query over DNSCurve, if an address record ( A or AAAA ) is sent,
> the corresponding DPCK record for the domain is also sent ( if it exists ), in the
> authority section.

I think the additional records section would make more sense than the
authority section.

---

From: Matthew Dempsky <[email-masked]>
Date: Fri, 4 Sep 2009 11:38:46 -0700