From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ore.jhcloos.com (ore.jhcloos.com [IPv6:2604:2880::b24d:a297]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "*.jhcloos.com", Issuer "CA Cert Signing Authority" (verified OK)) by huchra.bufferbloat.net (Postfix) with ESMTPS id 356EF21F1C1 for ; Mon, 28 Apr 2014 13:08:53 -0700 (PDT) Received: by ore.jhcloos.com (Postfix, from userid 10) id 37BD71DDCB; Mon, 28 Apr 2014 20:08:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=jhcloos.com; s=ore14; t=1398715732; bh=di8Ql4ZxqNm6NMPnQHOBQSIDMlkQYMECPPT3XyRQPsA=; h=From:To:Cc:Subject:In-Reply-To:References:Date:From; b=BxHlGZ00+CoMC3gOJtcWNabUqDXYCeKmdvr/JSzvNCOf3YI0gXwLOuMh0oA2/Zmu0 4U/lmgxDu/MqIXQbc/Kf865RNxVkiA2q1pk3zbfS0tdPH9LwV8dZgEci2yLvwQN4EG MoESEKNXD6m5ErCEJSu9fIhbfxzAh0Sc3Obnd4Fg= Received: by carbon.jhcloos.org (Postfix, from userid 500) id 1908D60028; Mon, 28 Apr 2014 19:57:43 +0000 (UTC) From: James Cloos To: Dave Taht In-Reply-To: (Dave Taht's message of "Mon, 28 Apr 2014 12:07:06 -0700") References: <535AAE37.103@thekelleys.org.uk> User-Agent: Gnus/5.13001 (Ma Gnus v0.10) Emacs/24.4.50 (gnu/linux) Face: iVBORw0KGgoAAAANSUhEUgAAABAAAAAQAgMAAABinRfyAAAACVBMVEX///8ZGXBQKKnCrDQ3 AAAAJElEQVQImWNgQAAXzwQg4SKASgAlXIEEiwsSIYBEcLaAtMEAADJnB+kKcKioAAAAAElFTkSu QmCC Copyright: Copyright 2014 James Cloos OpenPGP: 0x997A9F17ED7DAEA6; url=https://jhcloos.com/public_key/0x997A9F17ED7DAEA6.asc OpenPGP-Fingerprint: E9E9 F828 61A4 6EA9 0F2B 63E7 997A 9F17 ED7D AEA6 Date: Mon, 28 Apr 2014 15:57:43 -0400 Message-ID: MIME-Version: 1.0 Content-Type: text/plain X-Hashcash: 1:30:140428:dave.taht@gmail.com::lnq4+1TrVZQ4Q643:00000000000000000000000000000000000000000b1d9m X-Hashcash: 1:30:140428:simon@thekelleys.org.uk::LZOfV47Px4ED89h+:0000000000000000000000000000000000000vKVkW X-Hashcash: 1:30:140428:dnsmasq-discuss@lists.thekelleys.org.uk::LSCxOzu60Jx/3AHc:000000000000000000000zmoJT X-Hashcash: 1:30:140428:"cerowrt-devel\@lists.bufferbloat.net"::rR0vnVtK+gTg7vWg:00000000000000000000008rBkf X-Hashcash: 1:30:140428:cerowrt-devel@lists.bufferbloat.net::YCGyLHfcTxa+Meei:00000000000000000000000000iV+Q Cc: dnsmasq-discuss , "cerowrt-devel@lists.bufferbloat.net" Subject: Re: [Cerowrt-devel] [Dnsmasq-discuss] test-ipv6.com vs dnssec X-BeenThere: cerowrt-devel@lists.bufferbloat.net X-Mailman-Version: 2.1.13 Precedence: list List-Id: Development issues regarding the cerowrt test router project List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 28 Apr 2014 20:08:53 -0000 >>>>> "DT" == Dave Taht writes: DT> As one example of a registrar not with the program, name.com DT> (registrar for bufferbloat.net) does not allow for ds records to DT> come from it, so that domain can't be fully signed. DT> So it sounds to me as if negative proofs are not possible with DT> registrars that lack this support? No. Signed parent zones (like com, net, org) always provide either a signed DS record if it exists or proof of non-existance. Try doing: dig @i.gtld-servers.net. bufferbloat.net ds +dnssec The two nsec3 records (each signed by an rrsig record) prove that there is no DS record in net. with the name bufferbloat.net. Compare that with what you get asking for ns records: That replies with the two ns records, as well as the proof that the DS records do not exist. Now, try with a zone which is signed: dig @i.gtld-servers.net. jhcloos.net ns +dnssec dig @i.gtld-servers.net. jhcloos.net ds +dnssec The first returns both the ns and ds records, with an rrsig over the ds records (returned in the authority section); the latter returns the signed ds records in the answer section and net's own signed ns set in the authority section. Given that some zones have nameservers which fail to respond if they do not like or understand the query, it seems that only root-down verifi- cation can work. Unless I'm missing something.... -JimC -- James Cloos OpenPGP: 0x997A9F17ED7DAEA6