Subject: Re: I-D ACTION:draft-ietf-dnsext-ad-is-secure-03.txt

From: Brian Wellington <[email-masked]>
Date: Mon, 23 Jul 2001 14:03:13 -0700

On Mon, 23 Jul 2001, Edward Lewis wrote:

> At 4:13 PM -0400 7/23/01, Brian Wellington wrote:
> >> I still think that the draft should say that you MUST NOT set the AD bit
> >> without cryptographic verification of data. could we agree on this? if the
> >> server should try to verify the data at all is an implementational issue.
> >
> >No, we can't all agree on this.
> >
> >Let's say I have a signed zone.  I signed it myself.  I configured the
> >server myself.  I tested the server to make sure it's returning the right
> >answers, and they authenticate.  I know everything's correct.  Why can't
> >my server set the AD bit?
>
> Because the time between your verification of the data and my receipt of
> the data may be quite significant.

Even if the server does verify-on-query, that might be true.

> I would be more comfortable if the authoritative server only set the AA bit
> if the data is not checked on send.  I don't understand the rationale for
> wantint to se the AD bit without checking.  (Seems like the operation to
> set the bit would be a needless use of a cycle or two.)

We're going in circles.  The server would set the AD bit, if it used that
policy, so that recursive clients would see the AD bit.

> >If you don't want your server to behave that way, then don't use that
> >policy.
>
> What do you mean by that?  What other server can I use other than BIND?

BIND 9 doesn't set the AD bit on authoritative data at all.  And specific
implementations should have no impact on specs.  There's nothing stopping
you from writing your own server.

Brian

to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.

---

From: Brian Wellington <[email-masked]>
Date: Mon, 23 Jul 2001 14:02:29 -0700

Brian