Subject: Re: I-D ACTION:draft-ietf-dnsext-ad-is-secure-03.txt

From: Edward Lewis <[email-masked]>
Date: Mon, 23 Jul 2001 10:17:26 -0700

At 12:32 PM -0400 7/23/01, Brian Wellington wrote:
>On Mon, 23 Jul 2001, Edward Lewis wrote:
>
>> At 3:31 AM -0400 7/21/01, Jakob Schlyter wrote:
>> >is it still reasonable to treat the data as "Authenticated" when the
>> >signatures has expired?
>>
>> I think not, and this should be covered in a resolver document.
>
>I think Jakob was talking about an authoritative server, though.  The
>answer is probably "no", but enforcing this has major implications on the
>server, since it requires the server to inspect the data it's returning
>for every query, rather than just finding it and sticking it in the
>response.

So am I...Jakob and I (I think) both agree that the answerer (especially on
authoritative servers) should verify-on-reply.

>This sounds like another reason to split authoritative and caching
>service.  The recursive server will be doing the validation anyway, and
>can clamp the TTL based on the expiration time.

I think Brian's presumption is that the authortitative server should not
verify its own data because this represents a waste of time.  Others have
expressed the opinion that having the authoritative server verify on send
has two advantages.

First is that verify-on-send would allow the AD bit to be sent, thus making
the resolver look just for the AD bit to see if an answer is "secured."
(Let's not debate "secured" this instant.)  Currently, a resolver would
have to check the AA or AD bit to see if the answer is "secured or I
personally known it" (speaking for the answering server).  This current
situation slightly complicates the resolver.

(Before anyone starts flaming away, I'm just trying to document the state
of the discussion.)

Second is that the verify-on-send ensures that there is a currently valid
signature for the answer.  In the case of a temporal-swiss-cheese zone
(meaning there are temporal gaps in signature coverage) an answer shouldn't
emerge that might be accepted by a stub resolver.

Now for the flame bait.

My opinion is that I would like to have the option of having my server
verify-on-send.  I think a resolver should still accept an AD with TSIG on
par with AA with TSIG.  And I think any set in a signed zone that is not
properly signed should be seen as a SERVFAIL answer.

Okay, Brian, disagree away...;)

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                                NAI Labs
Phone: +1 443-259-2352                      Email: [email-masked]

You fly too often when ... the airport taxi is on speed-dial.

Opinions expressed are property of my evil twin, not my employer.

to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.

---

From: Brian Wellington <[email-masked]>
Date: Mon, 23 Jul 2001 09:32:24 -0700

Brian