Subject: Re: dnssec: super/subzone NULL keys

From: Jerry Scharf <[email-masked]>
Date: Thu, 06 Apr 2000 08:49:57 -0700

In the latest rev of secure DNS, the the delegation logic was changed such 
that the parent is no longer reqiured to keep the key for the child if the 
child is secure. So if you find a parent zone running secure and no null key, 
you have to go to the child's NS list and ask for the keys if they don't come 
in the authority section of a query. There were strong operational drives to 
get the live keys out of the parent zone.

Since the null key is an explicit statement that the zone is not secured, your 
solution seems to create a level of ambiguiry. I would fear that could cause 
too many implementation depenent actions.

jerry

to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.

---

From: Robert Elz <[email-masked]>
Date: Fri, 07 Apr 2000 01:27:55 +1000

Date:        Thu, 6 Apr 2000 14:28:57 +0200 (CEST)
    From:        Roy Arends <[email-masked]>
    Message-ID:  <[email-masked]>

  | a null-key for allmost every single delegation (at first, most delegated
  | zones will not be secure), a wild-card null key (* KEY 49408 3 3) can be
  | added, making the zone less redundant.

No it can't, wildcards don't work like that.

kre

---

From: Edward Lewis <[email-masked]>
Date: Thu, 6 Apr 2000 15:00:44 -0400

At 8:28 AM -0400 4/6/00, Roy Arends wrote:
>in its parent. Is there any problem for this superzone to keep the null
>key in its zone ?

Robert is right, wildcards don't work that way.

Jerry's point ("a level of ambiguity") is good too - the first thing I want
in security is to make sure I am not "confused" by the data.

Also, see and please comment on this draft:
    http://www.ietf.org/internet-drafts/draft-ietf-dnsext-zone-status-00.txt

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                                NAI Labs
Phone: +1 443-259-2352                      Email: [email-masked]

"Trying is the first step to failure." - Homer Simpson
"No! Try not. Do... or do not. There is no try." - Yoda
"It takes years of training to know when to do nothing" - Dogbert 1/21/00

Opinions expressed are property of my evil twin, not my employer.