Subject: Re: [dnsext] dnssec-bis-updates and the CD bit

From: Samuel Weiler <[email-masked]>
Date: Tue, 26 Jul 2011 13:28:11 -0400 (EDT)

On Mon, 1 Nov 2010, Florian Weimer wrote:

> Anyway, I have no problems with the text as-is (in -11, don't know if
> that's current).  Note however that the more or less explicit
> recommendation to set CD by default has security implications: you no
> longer profit from more stringent validation at an upstream validator.
> This should be mentioned in the Security Considerations.

I missed this when preparing -13.  I'm submitting a new version now 
that incorporates this suggestion.

> I think this is a very minor issue because even with the CD fixes, the
> protocol more or less requires that your forwarder has a superset of
> your own trust anchors.  Therefore, the situation that the forwarders
> perform more stringent checks is not a relevant scenario.

I don't understond why a forwarder must have "a superset of your own 
trust anchors", but I don't think that understanding is key to the 
point in the first paragraph I quoted above.

-- Sam

---

From: "Blacka, David" <[email-masked]>
Date: Wed, 27 Jul 2011 15:13:46 +0000

On Jul 26, 2011, at 1:28 PM, Samuel Weiler wrote:

> I missed this when preparing -13.  I'm submitting a new version now that incorporates this suggestion.
> 
> I don't understond why a forwarder must have "a superset of your own trust anchors", but I don't think that understanding is key to the point in the first paragraph I quoted above.

I don't think it is a "must", actually.  What Florian is likely getting at is that if your forwarder does not have a superset of your trust anchors (well, a superset of your validation policy as a whole), then it is possible that you can fail a response when the forwarder does not, and thus get stuck.  If the forwarder does have a superset, then presumably querying without a CD bit will cause the bad answer to get removed from the forwarder's cache.

--
David Blacka                          <[email-masked]> 
Principal Engineer      Verisign Infrastructure Engineering

---

From: Ondřej Surý <[email-masked]>
Date: Wed, 27 Jul 2011 13:24:57 -0400

> I don't think it is a "must", actually.  What Florian is likely getting at is that if your forwarder does not have a superset of your trust anchors (well, a superset of your validation policy as a…

Just a note...  Are you sure that "namedroppers" is the right list?

(Strange that you can post there at all...)

O.
-- 
  Ondřej Surý
  vedoucí výzkumu/Head of R&D department
  -------------------------------------------
  CZ.NIC, z.s.p.o.    --    Laboratoře CZ.NIC
  Americka 23, 120 00 Praha 2, Czech Republic
  mailto:[email-masked]    http://nic.cz/
  tel:+420.222745110       fax:+420.222745112
  -------------------------------------------

---

From: Samuel Weiler <[email-masked]>
Date: Wed, 27 Jul 2011 13:55:52 -0400 (EDT)

> Just a note...  Are you sure that "namedroppers" is the right list?

Not at all.  I (and we) presumably just hit "reply all" or the 
equivalent.  Florian had originally posted to namedroppers, back in 
the good old days.

> (Strange that you can post there at all...)

Yes.

-- Sam