Subject: DNSEXT WG Last Call: AD is Secure

From: Olafur Gudmundsson <[email-masked]>
Date: Tue, 13 Mar 2001 11:35:03 -0500

This document clarifies/updates certain sections of RFC2535
redefines/restricts the use of the AD bit in DNS header to be only set
when server has cryptographically verified the answer.
The reason for this is to make allow clients to take advantage of
server that is willing to perform cryptographic checks for client.

This WG last call ends March 29'th 2001.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-dnsext-ad-is-secure-01.txt

This draft is on standards track, if you disagree with that please state why
in your response.

          Olafur

to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.

---

From: Bob Halley <[email-masked]>
Date: 28 Mar 2001 08:39:34 -0800

> This draft is on standards track, if you disagree with that please state why

The draft says:

   If the answer section contains any data, the server MUST NOT include
   data in the authority section that would cause the AD bit to be
   unset.

This is a problem, since we could have a CNAME/DNAME chain that
started in a secure zone and ended in an unsecure zone where the name
exists but the desired rdata type does not.  We'd like to put the
(unsigned) SOA into the authority section to make a negative response,
but the text of the draft forbids this.

The only value of AD is to a "DNSSEC mostly unaware" client who wants
to know that "the answer" to its question was authenticated; a fully
aware implementation will simply ignore AD and validate the signatures
itself.

I think the draft should be revised, saying something like:

	AD should be set if and only if all RRs in the answer section,
	and any relevant negative response RRs in the authority
	section are Authenticated.

/Bob