Subject: Re: Question about TSIG, AD/AA, and AXFR

From: Jakob Schlyter <[email-masked]>
Date: Tue, 17 Jul 2001 12:47:13 -0700

On Tue, 17 Jul 2001, Edward Lewis wrote:

> From you message it sounds like no one should trust data with the AA bit,
> as this means the authentication has not been checked.  This is an ironic
> conclusion, as we've been assigning more credibility to AA'd data.  (Once
> again, the credibility vs. authenticated issue arises.)

the nameserver should never set the AD bit without actually verifying the
data. some earlier version of bind did set AD if the server itself were
authorative. I belive this is wrong - data shouldn't be checked on load,
it should be checked on query.

I think the AA-bit could be trustworthy for very simple resolvers that,
for some reason, do trust their local resolver.

	jakob

to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.

---

From: Edward Lewis <[email-masked]>
Date: Tue, 17 Jul 2001 13:39:58 -0700

>it should be checked on query.

What are the chances that this will happen, I mean software development
wise?  It does make more sense to check on query for two reasons - the SIG
validity is more timely and the need to get other data (the key chain)
shouldn't slow the loading process.

>for some reason, do trust their local resolver.

I don't think this as "special case" as you make it seem.

  -------------------------------- (network A)
    |             |
  Host         NS/FW
                 |
             --------------------- (network B, ie, the Internet)

Assuming NS/FW is recursive only for hosts on A, uses TSIG (possibly the
criteria for recursion), but answers authoritatively for domains on both A
and B:

Host should "trust" answers that pass the TSIG test and have either AA or
AD.  Answers with TSIG and neither ought to be used as "as best as can be
gotten, but obviously unreliable."  I think a good question is what is the
interaction of the "gimme DNSSEC records" bit, the AA bit, and validity
period checking.  If the authoritative server does not check the validity
period, and the SIGs aren't sent, then the stub might accept temporally
invalid data.

I think I (or someone) needs to document the cases in a more formal way to
make sure we're on the same page.  To late for an I-D, but perhaps
something will be distributed on [email-masked] in the next few weeks.

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                                NAI Labs
Phone: +1 443-259-2352                      Email: [email-masked]

You fly too often when ... the airport taxi is on speed-dial.

Opinions expressed are property of my evil twin, not my employer.

---

From: Yuji Kamite <[email-masked]>
Date: Wed, 18 Jul 2001 05:49:23 -0700

On Tue, 17 Jul 2001 13:39:58 -0700

> period, and the SIGs aren't sent, then the stub might accept temporally

I have a question about AD and "gimme DNSSEC records".
Is it allowed to return responses with AD bit even if
they do not include SIG, NXT and so on?
I'm a little confused with usage of AD because the
definition about AD in documents seems to be obscure, especially
about when it must be set.

For example, in BIND9 implementaition, recursive resolver
seems to set AD flag in answer if given query has "gimme DNSSEC records" bit.
It does not set AD unless given query has "gimme DNSSEC records" bit
even when the RRs themselves are Authenticated by the server.
Is this right behavior?

I think it might be okay for the recursive resolver to
reply AD-set answer without DNSSEC-related RRs, if the RRs have been
authenticated (i.e. if the server has succeeded to verified
the RRs' SIGs according to trust chains) and the message to the
stub-resolver are protected by TSIG.

>From the view of the host (stub-resolver) which asked the recursive
resolver, it would like to trust all tasks of the resolver by means of
adding TSIG into queries. But it depends totally on the stub-resolver
whether it will send queries with "gimme DNSSEC records" bit.
Stub-resolver may send query without "gimme DNSSEC records" bit,
if it wants to restrict the packet size exchaged.

In this case, queries and responses between stub-resolver
and recursive resolver are protected by TSIG, so,
I think only if the answer's AD can be set, stub-resolvers might be
able to trust aquired RRs' validity.

--
Yuji Kamite
Information Technology Center, Univ. of Tokyo
E-Mail: [email-masked]