Subject: Re: DS and cache transparency.

From: Edward Lewis <[email-masked]>
Date: Mon, 4 Nov 2002 09:15:04 -0500

At 14:37 -0500 10/28/02, Ólafur Guðmundsson wrote:
>At 14:12 2002-10-28, Olaf Kolkman wrote:
>
>>  >>  > My question is did we ever consciously decide to live with the
>>  >>  > architectural constraints or is there still work to do on defining the
>>  >>  > label magic?
>>  >>
>>  >>  I'd rather live with the constraints and avoid the label voodoo.
>>
>>Perfect...
>>
>>Should the 'only DNSSEC in line of sight" constrain be made explicit
>>in the DS draft?
>
>This is applies not just to DS but all DNSSEC Records and should
>be mentioned in the DNSSEC-bis protocol document.

Well, only the DS RR is the problem, but it condemns the other DNSSEC 
RR's as well.  Because it may happen that a cache with a resolver 
that is unaware of the implications of the DS RR just might get asked 
to retrieve a DS RR for an aware resolver, I'm afraid that such a 
constraint is needed.  (I hate constraints.)

Because a resolver seeking a DS RR has to be smart enough to ask the 
parent and not the child zone, only aware resolvers should ever have 
to go look for a DS RR.  And without the DS RR's available, the other 
records become useless.

I hope this comment is in-line with the discussion.  I'm not 
completely sure I grok the intent, but I think this is what is being 
asked here.
-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                          +1-703-227-9854
ARIN Research Engineer

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: [email-masked]
Date: Tue, 05 Nov 2002 07:20:39 +1100

> completely sure I grok the intent, but I think this is what is being 

	Getting only DS aware servers in the line of site is the small
	part of the problem.

	The main problem however is that you can't stop a non DS
	aware cache being asked about DS.  You need to give back a
	answer to such a cache that will not result in it treating
	the server as lame.

	Mark

--
Mark Andrews, Internet Software Consortium
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

---

From: [email-masked]
Date: Tue, 05 Nov 2002 17:52:49 +1100

> 
>  * You're right, the problem is that a non-DS aware resolver will ask 
>  * the child and not the parent, which leads to the problem.  If nothing 
>  * else, the resolver will get the wrong impression from the child, up 
>  * to the possiblity that the child is lame.
> 
> 
> I think it's safe to conclude that we do not want to 'fix' this
> problem with a namespace hack so that the parent becomes authoritive
> for DS RRs. (e.g. by adding a null byte to the first label as somebody
> (Derek???) suggested)
> 
> That was my initial question after all :-)
> 
> --Olaf

	I think that was the feeling of everyone that responded.

	Mark

---

From: Edward Lewis <[email-masked]>
Date: Tue, 5 Nov 2002 09:55:31 -0500

>	I think that was the feeling of everyone that responded.

me too.