Re: I-D ACTION:draft-ietf-dnsext-ad-is-secure-03.txt

[Roy Arends <[e-mail]>]

Ha ! , responding to myself :-)

Anyway, after an offlist discussion between Brian and myself, I understand
and agree with his point of view. It boils down to the following:

AD bit indicates data has been authenticated. A cache MUST have
authenticated the data when it has the AD bit set on responses.

Authoritative and signed data, stored on disk, may have been authenticated
already, and therefor authenticating it again is doubling the effort.

If an adminstrator authenticated the data on disk according to its policy,
it may instruct the server to treat it as such, without having the server
actually authenticate the data itself.

Ofcourse this could mean that the data served by an authoritative server
is not authenticated at all while the AD is set, but that is the
responsibility of the administrator/domain holder.

So, apart from a few small clarifications, I agree with the draft.

Regards,

Roy Arends
Nominum



to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.