paul at nohats.ca wrote
Thu, 14 Apr 2016 11:08:14 -0400 (EDT):
| On Thu, 14 Apr 2016, Linus Nordberg wrote:
|
| > | Is the absence of a DS also stored in the log? I.e. the NSEC(3) proof?
| >
| > No. That is not in the draft and was not something we discussed at the
| > DNSSEC Trans meeting in Yokohama as far as I can recall.
|
| I think we did discuss it and said it was needed :)
OK. I probably just didn't understand. :)
| While it is not very interesting for domains that were never signed, it
| is of great interest to those that have had a DS in the past, as it
| might be an attack by the parent to turn the child into insecure mode,
| so they can then spoof any record of the child.
Would you be able to describe how this should be done? Preferably in
form of a patch to draft-zhang-trans-ct-dnssec-03.
| > Interest in this has been expressed on this list before [1] but no
| > concrete suggestions on how this should be done have been presented so
| > far.
|
| It would require the two NSEC(3) records that prove this, but their
| chain.
Does not parse.