Subject: Re: type codes (Re: wildcard optimization and b/w incompatibility )

From: Michael Richardson <[email-masked]>
Date: Thu, 21 Nov 2002 22:57:19 -0500

-----BEGIN PGP SIGNED MESSAGE-----

>>>>> "Jaap" == Jaap Akkerhuis <[email-masked]> writes:
    Jaap> Yes, I too have always wondered why people are so hang-up on
    Jaap> compatabilaty with 2535, a propossed standard, hardly been deployed
    Jaap> and according to the rules should not be deployed for disruption-sensitive
    Jaap> producting work. (RFC 2026, secton 4.1.1).

  My understanding is that we have a problem whenever there is a caching
resolver in the way that is not DS aware. It doesn't matter if it is 2535
aware or not.

  As I understand the problem, it is irrelevant whether or not it is 2535
aware, so long as it can deal with records that it doesn't understand. If it
fails to return SIG/NXT/KEY records because it doesn't understand them, then
there is no problem. 

]                   At IETF55 in Atlanta, GA                    |  firewalls  [
]   Michael Richardson, Sandelman Software Works, Ottawa, ON    |net architect[
] [email-masked] http://www.sandelman.ottawa.on.ca/ |device driver[
] printk("Just another Debian GNU/Linux using, kernel hacking, security guy");[

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Paul Vixie <[email-masked]>
Date: Fri, 22 Nov 2002 04:12:41 +0000

> To quote the "A-Team":  That's so crazy it just might work!

i apologize for keeping the thought to myself for the last year, then.
(i keep wanting to stay out of dnssec's innards because security hurts
me to think about, but then dnssec keeps running aground on issues more
related to dns than security... i promise to speak up sooner next time.)

> But I still have some doubts.  That will help identify the "true" security
> aware servers/resolvers, but will it help the problem of a non-DS aware
> cache between the resolver and authoritative server?

no, and it isn't expected to.  what we want to do is limit the cases to
"pre-dnssec" and "current-dnssec" and not "interim-dnssec-N" or even
"interim-dnssec-N+1".

> If a recursive forwarder doesn't know where to ask for the DS record,
> it doesn't matter what the type code is.

right.  but that problem is separately tractible.  later tonight i will write
in with "ENS", which while uglier than sin, may yet be prettier than namehack.