Subject: Re: I-D ACTION:draft-ietf-dnsext-ad-is-secure-03.txt

From: Brian Wellington <[email-masked]>
Date: Mon, 23 Jul 2001 13:49:35 -0700

On Mon, 23 Jul 2001, Jakob Schlyter wrote:

> On Mon, 23 Jul 2001, Brian Wellington wrote:
>
> > > verify-on-send could of course be configurable, as recursion is in some
> > > servers.
> >
> > I'd much prefer to see a server with a "recursive" view and an
> > "authoritative" view, where all recursive querie went through the
> > recursive view.  This would allow the server verify authoritative data
> > (when the query has the RD bit set), without complicating the
> > authoritative server.
>
> this sounds reasonable.
>
>
> perhaps we should go back to discussing the draft?
>
> I still think that the draft should say that you MUST NOT set the AD bit
> without cryptographic verification of data. could we agree on this? if the
> server should try to verify the data at all is an implementational issue.

No, we can't all agree on this.

Let's say I have a signed zone.  I signed it myself.  I configured the
server myself.  I tested the server to make sure it's returning the right
answers, and they authenticate.  I know everything's correct.  Why can't
my server set the AD bit?

If you don't want your server to behave that way, then don't use that
policy.

Brian

to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.

---

From: Edward Lewis <[email-masked]>
Date: Mon, 23 Jul 2001 13:54:18 -0700

>my server set the AD bit?

Because the time between your verification of the data and my receipt of
the data may be quite significant.

I would be more comfortable if the authoritative server only set the AA bit
if the data is not checked on send.  I don't understand the rationale for
wantint to se the AD bit without checking.  (Seems like the operation to
set the bit would be a needless use of a cycle or two.)

>If you don't want your server to behave that way, then don't use that

What do you mean by that?  What other server can I use other than BIND?

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                                NAI Labs
Phone: +1 443-259-2352                      Email: [email-masked]

You fly too often when ... the airport taxi is on speed-dial.

Opinions expressed are property of my evil twin, not my employer.

---

From: Jakob Schlyter <[email-masked]>
Date: Mon, 23 Jul 2001 13:51:35 -0700

> my server set the AD bit?

because the signature will expire and you will set the AD bit on data that
is no longer authenticated.

I've assumed that authenticated means "authenticated using DNSSEC". if you
have another definition, your may be correct.

	jakob