Subject: Re: [dnsext] dnssec-bis-updates and the CD bit

From: Florian Weimer <[email-masked]>
Date: Mon, 01 Nov 2010 14:24:55 +0000

* Andrew Sullivan:

> Our minutes from Maastricht say this:
>
>           Existing item: draft-ietf-dnsext-dnssec-bis-updates
>           - small number of hums for the "roll over and die" text is not okay and
>           no hums for the text is okay
>           - observation: few seem to have read the draft
>           - demonstration of the "roll over and die" behaviour was given
>           - CD-bit handling: nobody objected to having a default - unlike the two
>           people on the mailing list

What is a "hum"?  Does it express agreement or disagreement?

Anyway, I have no problems with the text as-is (in -11, don't know if
that's current).  Note however that the more or less explicit
recommendation to set CD by default has security implications: you no
longer profit from more stringent validation at an upstream validator.
This should be mentioned in the Security Considerations.

I think this is a very minor issue because even with the CD fixes, the
protocol more or less requires that your forwarder has a superset of
your own trust anchors.  Therefore, the situation that the forwarders
perform more stringent checks is not a relevant scenario.

-- 
Florian Weimer                <[email-masked]>
BFK edv-consulting GmbH       http://www.bfk.de/
Kriegsstraße 100              tel: +49-721-96201-1
D-76133 Karlsruhe             fax: +49-721-96201-99

---

From: Joe Abley <[email-masked]>
Date: Wed, 3 Nov 2010 08:35:05 -0400

> What is a "hum"?  Does it express agreement or disagreement?

Agreement. The implication that should be drawn from Andrew's text is that the room felt the text was not ok, but on the whole the number of people expressing an opinion was small, hence the following observation.

Joe

---

From: Andrew Sullivan <[email-masked]>
Date: Wed, 3 Nov 2010 09:47:44 -0400

> What is a "hum"?  Does it express agreement or disagreement?

A hum indicates agreement with the proposition.  We had proposed text
(not actually in the -11, note: the draft as is says it's a
"placeholder") that was supposed to go in here.  I can't put my hands
on the proposed text at the moment, however.  Editors?

The CD bit handling says that nobody objected to having a default.
What we were planning to do was to outline the three "strategies" and
say "do always set by default".  Nobody seemed to object in the
meeting.

A
-- 
Andrew Sullivan
[email-masked]
Shinkuro, Inc.

---

From: Samuel Weiler <[email-masked]>
Date: Wed, 10 Nov 2010 02:18:08 -0500 (EST)

Based on today's DNSEXT meeting, I have updated the draft.  Two 
changes have been made:

1) The placeholder text describing the rollover and die problem has 
been removed.  The recommendation to use a BAD cache remains, though 
without much explanation.  If you don't like this, send text.

2) The previous weak recommendation about setting the CD bit has been 
changed to a SHOULD.

-- Sam, doc editor