Subject: Re: draft-ietf-dnsext-zone-status-02.txt

From: Roy Arends <[email-masked]>
Date: Thu, 20 Jul 2000 12:36:45 +0200 (CEST)

Comments by Roy Arends from NLnet Labs on the I-D

   DNS Security Extension Clarification on Zone Status
   <draft-ietf-dnsext-zone-status-02.txt>
   July 12, 2000, by Edward Lewis.

> 1.1 When a Zone's Status is Important

A few times there is mentioning of "the parent states that the child is
secured".

The parent holds the KEY information to verify the parent's SIG over the
child's KEY or null-KEY.  Only in the case where a child is clueless, a
parent states that the child is _not_ secure, by holding a signed
NULL-key for the child in their zone. In all other cases, information
on child-status in the parent zone is redundant.

> 1.2 Islands of Security

This clarification is very welcome.

> 2.1.c. NXT records MUST be deployed throughout the zone. (Updates RFC
> 2535, section 2.3.2.)  

As discussed in previous remarks, this update is not neccesary. The
requirement is already there. This is a clarification, not an update. It
does not change the protocol.

> Note: there is some operational discomfort with
> the current NXT record.  This requirement is open to modification when
> two things happen.  First, an alternate mechanism to the NXT is
> defined and second, a means by which a zone can indicate that it is
> using an alternate method.

This seems to point to section 3 & 4 which are deleted.

> 2.2.c. NXT records MUST be deployed throughout the zone. (Updates RFC
> 2535, section 2.3.2.) Note: see the discussion following 2.1.c.

As mentioned at 2.1.c this update is not neccesary.

As for 2.1.d and 2.2.d, the terms privately & fully secure are welcome
when it comes to evaluating a zone's status (as mentioned in 2.4). For
clarification purposes updating a proposed standard seems unnecessary.

Regards,

Roy Arends
NLnet Labs

to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.

---

From: Edward Lewis <[email-masked]>
Date: Fri, 21 Jul 2000 07:07:06 -0400

>on child-status in the parent zone is redundant.

I'm not completely clear on your comment, so allow me to jump to a
conclusion.   I claim that "parent states a child is secured (or not)" is a
requirement of DNS security.  I think (this is the jump) that you think
that I think that the only way to do this is with an explicit record or bit
in the parent.  But I don't think (umm, the latter think) so.

The fact that there is confusion here is because of an issue Mark Kosters
and I have come to roaring agreement upon.  In RFC 2535, if a parent and
child are secured, then the parent may "be silent" about the child.  If a
sibling is unsecured, the parent will have an explicit null KEY record.  In
summary, secured delegations are implicit and unsecured delegations are
explicit.  Mark I and I don't like this design "feature" but that's how the
spec is written.

So, I say that the parent indicates that a child is secure (when
appropriate).  RFC 2535 says that this is done by saying nothing - which
meets the requirement.  The confusion existing over the "meeting" of the
requirement is one of many nuisances of the specification.  Nuisances are
not reasons to stop, change, etc., at this time, however.

So (again), your're answer is 100% correct, but it is not in conflict with
my statements.  I appologize for two things - the complexity of this topic
and for possibly leaping to the wrong conclusion about the discussion.

>does not change the protocol.

Hmmm, why did I screw that up.  You're right, I guess I've just tied myself
into a knot trying to get this draft updated.  (This isn't a "it's the
deadline" excuse, these words have been there quite a while.)

>This seems to point to section 3 & 4 which are deleted.

Yeah, now, this is a "it's the deadline" excuse.  I wasn't too careful to
remove all references to the dropped proposal.

>clarification purposes updating a proposed standard seems unnecessary.

Hopefully we can have a face to face meeting on this in Pittsburgh, or
during a *possible* European swing in September.

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                                NAI Labs
Phone: +1 443-259-2352                      Email: [email-masked]

"It takes years of training to know when to do nothing" - Dogbert

Opinions expressed are property of my evil twin, not my employer.