Subject: Re: I-D ACTION:draft-ietf-dnsext-ad-is-secure-03.txt

From: Brian Wellington <[email-masked]>
Date: Mon, 23 Jul 2001 15:35:04 -0700

On Mon, 23 Jul 2001, Randy Bush wrote:

> > It's also up to the server authors.  Speaking as the person most likely to
> > implement this, I think it's a really bad idea.
>
> whoops!  while implementors certainly deserve our sympathy, we need to also
> be conscious of what users want and what is the technically best protocol.
> i hope you can separate your roles as document editor and as implementor.

Sorry if I gave a bad impression.  I'll try to clear it up.

As the document editor, I think that all of the following are reasonable
ideas for handling authoritative data, and should be allowed by the spec.

 - validation at query time
 - validation at startup
 - setting the AD bit without explicit server validation
 - never setting the AD bit.

None of these are wrong, and that's why the draft specifies that the
server may set the AD bit, according to local policy.  If anyone thinks
that one of these is more correct than the others, they can use that
policy.

As an implementor, I hope to never implement validation at query time,
because it's horribly complicated.  The others aren't too bad.

Brian

to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.

---

From: Roy Arends <[email-masked]>
Date: Tue, 24 Jul 2001 07:43:18 -0700

> because it's horribly complicated.  The others aren't too bad.

As an administrator, I have tested the following:

An alternative for validation at query time for BIND 9.

A server (BIND 9), using views where in the authoritative view only the
server itself is allowed to query (and secondaries), and the recursive
view where the world is allowed to query. That plus a trusted key
statement for the zones on disk. This will result in a server which loads
data from disk, and at query time will validate the answer, and if
appropriate, sets the AD bit in the response, in responses to world.

Validation at query time & loaded from disk by the same server.

Roy Arends
Nominum