Subject: Re: DNSSECbis Q-9: Dropping SIG(NXT) in authoritative section for neg. response.

From: Sam Weiler <[email-masked]>
Date: Thu, 5 Jun 2003 14:25:38 -0400 (EDT)

On 20 May 2003, Bob Halley wrote:

> I support keeping the current language.
...
> More importantly, separating SIGs from what they sign is something to
> avoid.  Whenever you separate a SIG, you run into the possibility that
> the SIG you subsequently fetch will be for another version of the
> data.  When the SIG doesn't verify, the validator must not treat that
> as a failure of validation, but instead must refetch both data and its
> SIG and try again.

Querying for SIGs is bad, yes.  Querying for NXT, though, gives you
the SIG you need.

The problem is that wildcard proofs have to return a NXT who's owner
name can't be predicted by the validator.  If you return that NXT,
sans SIG, the validator could query for the NXT and get the SIG, all
without TCP fallback, right?

Question: are there caches that will see an NXT in an authority
section, and reply to NXT queries with that RR, forcing a SIG query?
If so, leave the language as is.  If not, why not change it?

-- Sam

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>