Subject: [homenet] Eric Rescorla's Discuss on draft-ietf-homenet-dot-13: (with DISCUSS)

From: Eric Rescorla <[email-masked]>
Date: Wed, 30 Aug 2017 16:20:07 -0700

Eric Rescorla has entered the following ballot position for
draft-ietf-homenet-dot-13: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-homenet-dot/

----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------

       A.  Recursive resolvers at sites using 'home.arpa.'  MUST
           transparently support DNSSEC queries: queries for DNSSEC
           records and queries with the DO bit set ([RFC4035] section
           3.2.1).  While validation is not required, it is strongly
           encouraged: a caching recursive resolver that does not
           validate answers that can be validated may cache invalid
           data.  This in turn will prevent validating stub resolvers
           from successfully validating answers.

I don't understand the rationale for this requirement. As I understand it from
this document, stuff ending in home.arpa cannot be DNSSEC validated, so what's
it the business of this document to levy the requirement on sites which support
home.arpa that they do anything with DNSSEC at all.

---

From: Mark Andrews <[email-masked]>
Date: Fri, 01 Sep 2017 12:39:08 +1000

In message <[email-masked]>, 
Eric Rescorla writes:
> I don't understand the rationale for this requirement. As I understand it
> from this document, stuff ending in home.arpa cannot be DNSSEC validated,
> so what's it the business of this document to levy the requirement on
> sites which support home.arpa that they do anything with DNSSEC at all.

Wrong the responses can be validated.  The output of the validation
step is one of secure, insecure, or bogus.  With the exception of
home.arpa/DS and without private trust anchors being installed the
output of that validation should be insecure for all answers from
home.arpa.  home.arpa/DS should validate as secure NODATA.

In particular validation of the home.arpa/DS is important as it
prevents the cache being poisoned with answers which prevent the
stub proving that the home.arpa is supposed to exist and that it
doesn't have a chain of trust from the root.

Mark

> _______________________________________________
> homenet mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/homenet
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]