Subject: Re: I-D ACTION:draft-ietf-dnsext-ad-is-secure-03.txt

From: Roy Arends <[email-masked]>
Date: Mon, 23 Jul 2001 16:10:32 -0700

On Mon, 23 Jul 2001, Edward Lewis wrote:

> At 3:40 PM -0400 7/23/01, Roy Arends wrote:
> >
> >The key point here is "don't set the AD bit without locally verifying the
> >data". Exactly true, no arguments here. BUT, I happen to verify the data
> >every single day by re-signing the zone. I do not want the extra burdon of
> >double authentication.
>
> The BIND 9 signer doesn't always verify the signatures it generates.
> (There's an option to do so, but the server can't tell if it has been used.)

No problem, If I tell the server to trust the data on disk (according to
local policy, etc etc), it should not care.

> >In the general case it would be better if a stub (non-crypto-doing)
> >resolver (lemme rephrase that : ANY resolver !) were using a recursive
> >server, because it saves bandwith, load on authoritative servers. This
> >is also true in the cache that someone is doing DNSSEC, regardless of
> >this draft.
>
> Don't pin me into having to use the server just one way!  Many folks will
> combine the authortitative server with a (local-only) recursive server,
> e.g., as on a firewall.

I'm not doing that, combine authoritative and recursive in whichever way
it is conveniant. I said "in the general case" and "would be better" for
the situ in general, regardless of crypto.

> >Because it does not add extra trust.
>
> It's not always about trust.  (See my earlier message about signature
> validity and verifying the key chain.)

Trust following local policy. That includes ofcourse how data is handled,
how the authoritative server is configured, this should include a
statement that the administrator is aware- and will take care of,
expirating sigs.

> >> Why do I have to buy into the mantra "I just trust what's on my disk?"
> >
> >Come'on, this is like saying, "I wanna trust the server, but I don't want
> >automagically want to trust the data, so the server must validate it". Why
> >would a malicious user not compromise the server-software, if it could
> >compromise the data on disk.
> >
> >If you want to trust an authoritative nameserver, use TSIG/SIG(0), it is
> >the only real trust mechanism in this particular scheme.
>
> Well, there is IPSEC too.

What I mean is "If you want to be able to trust an authoritative
nameserver, do not only rely on the AD bit, but have some transaction
authentication in place".

> But my point here is that I don't want the specification to be limited
> by what is implemented.

The specification is not limited, its more open.

Roy Arends
Nominum

to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.

---

From: Roy Arends <[email-masked]>
Date: Mon, 23 Jul 2001 16:10:32 -0700

Roy Arends
Nominum