Subject: Re: I-D ACTION:draft-ietf-dnsext-ad-is-secure-03.txt

From: [email-masked] (Ted Lindgreen)
Date: Tue, 24 Jul 2001 15:12:39 -0700

[Quoting Edward Lewis, on Jul 24, 20:33, in "Re: I-D ACTION:draft ..."]

> Although I have been arguing for verify-on-send/reply, ...

I totally agree with this, like probably almost everyone else on
this list, certainly for the common case of all reasonably sized
zones, which is > 99% of all zones. A special solution (an option
to disable it) seems more logical to cope with the special case.

I can understand that for a handfull of superlarge zones like .com,
BIND can run into a performance problem, but I don't understand
why this must lead to not implement signature checking of local
data at all into nameserver software meant for general use.

Or should we conclude from this that BIND-9, in contrast to all
previous BIND implementations, is geared towards the special
case of superlarge zones, and this special case only?

Also, another proposal from Nominum (Roy Arends) to separate the
functions from authorative servers and caching forwarders, which
does not fit in many (most?) situations, like nameservers on company,
university, etc. networks, seems to support the above conclusion.

However, I can not believe that such is what ISC wants, and what
the various organisations that donate to ISC for BIND development
expect. Or am I missing something?

Confused,
-- ted

to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.

---

From: Roy Arends <[email-masked]>
Date: Wed, 25 Jul 2001 05:57:15 -0700

> university, etc. networks, seems to support the above conclusion.

If you are referring to my mail from today which stated "as an
administrator", this was merely an alternative for validation at query
time, using views. Works like a charm.

Please enlighten me why it does not fit in many (most?) situations, like
nameservers on company, university, etc. networks.

> Or should we conclude from this that BIND-9 in contrast to all

The draft is a protocol design issue. Please don't confuse implementations
with protocols.

Now, going back to the draft, I see the following as correct (and generic
for _all_ implementations that wish to implement this):

On Mon, 23 Jul 2001, Brian Wellington wrote:

> As the document editor, I think that all of the following are reasonable
> ideas for handling authoritative data, and should be allowed by the
> spec.
>
> - validation at query time
> - validation at startup
> - setting the AD bit without explicit server validation
> - never setting the AD bit.
>
> None of these are wrong, and that's why the draft specifies that the
> server may set the AD bit, according to local policy.  If anyone thinks
> that one of these is more correct than the others, they can use that
> policy.

Regards,

Roy Arends
Nominum