Subject: Re: DNSSECbis Q-9: Dropping SIG(NXT) in authoritative section for neg. response.

From: Samuel Weiler <[email-masked]>
Date: Mon, 28 Jul 2003 10:23:12 -0700 (PDT)

[Here's another message that kept bouncing.]

(Possibly reopening Q-9.  Sorrry, Scott.)

> More importantly, separating SIGs from what they sign is something to
> avoid.  Whenever you separate a SIG, you run into the possibility that
> the SIG you subsequently fetch will be for another version of the
> data.  When the SIG doesn't verify, the validator must not treat that
> as a failure of validation, but instead must refetch both data and its
> SIG and try again.

Given that the validator action when presented with an NXT and no SIG(NXT)
will probably be to query for that NXT, not SIG, is this worry mitigated?  
The (possibly new) data and accompanying SIG will arrive atomically, and
the new NXT will replace any stale NXT.

-- Sam

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>