<html><head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head><body bgcolor="#FFFFFF" text="#000000"><br>
<br>
<blockquote style="border: 0px none;"
cite="mid:CAA=nHSKmSDLmS4QY8pn3ZHD-7X9G8vigdnbjN35iFePf2UjgJw@mail.gmail.com"
type="cite">
<div style="margin:30px 25px 10px 25px;" class="__pbConvHr"><div
style="display:table;width:100%;border-top:1px solid
#EDEEF0;padding-top:5px"> <div
style="display:table-cell;vertical-align:middle;padding-right:6px;"><img
photoaddress="ggm@apnic.net" photoname="George Michaelson"
src="cid:part1.02010703.01020100@redbarn.org"
name="compose-unknown-contact.jpg" height="25px" width="25px"></div> <div
style="display:table-cell;white-space:nowrap;vertical-align:middle;width:100%">
<a moz-do-not-send="true" href="mailto:ggm@apnic.net"
style="color:#737F92
!important;padding-right:6px;font-weight:bold;text-decoration:none
!important;">George Michaelson</a></div> <div
style="display:table-cell;white-space:nowrap;vertical-align:middle;">
<font color="#9FA2A5"><span style="padding-left:6px">Monday, December
01, 2014 5:56 PM</span></font></div></div></div>
<div style="color:#888888;margin-left:24px;margin-right:24px;"
__pbrmquotes="true" class="__pbConvBody"><div dir="ltr">Here is a
strawman, to try and understand the discussion.<div><br></div>...<div><br></div><div>Why
is this worse than eg an RR by RR comparison, walking the NSEC chains?
What I like about it, is that its applicable to being given the data
OOB. if you have what is a putative zone, then you can apply this logic,
and determine if the zone matches what is published elsewhere as a
canonical state of the zone.</div><div><br></div><div>The RR by RR and
NSEC walk feels like a DNS experts approach. Not a systems/generic
approach.<br>
</div></div></div>
</blockquote>
<br>
if we change the use case to 'tertiary server operator wants to be sure
zone is correct' where correct means not just that it came from the
authorized source and has not been tampered with, but also that the
authorized source did not bungle their duties, then a zone level
signature whether in-band or detached would not be adequate. it would
literally be nec'y to ensure that there are no records between the
NSEC's and that every RRSIG matches its RRset and no RRsigs are
extraneous and no RRsets (other than as permitted by "opt out") remain
unsigned.<br>
<br>
in my own history of having once operated a COM/NET/ORG secondary (which
all the root name servers did for many years), the only time we had an
emergency was when the zone generation logic had a failure, and there
were a lot of missing subdomains for a few minutes/hours. a zone-level
signature might not have caught that, depending on where in the work
flow that signature (whether in-band or detached) was generated.<br>
<br>
<div class="moz-signature">-- <br>Paul Vixie<br>
</div>
</body></html>