Re: restart: Re: I-D ACTION:draft-ietf-dnsext-ad-is-secure-03.txt

[Edward Lewis <[e-mail]>]

At 2:07 PM -0400 7/27/01, Brian Wellington wrote:

Finally - I can see the motivation.  "Intents," or requirements, should
appear in the introduction to set the context for the document.

>And all I want is the ability to run an authoritative server without
>crypto that can set the AD bit to 1 on data that is secure.

I don't think this should be permitted.  Why is it so important to have the
AD bit set to 1 if the answering server does not bother with cryptography?

The AA bit and AD bit exist on different planes of the DNS protocol.  (This
is a bit abstract.)  AA rests on the name server plane, and is
topology-based.  The AA bit indicates that there is no better place to get
an answer than this.  AD rests on the zone data plan, it relates to the
end-to-end security of data from its zone to the resolver.  The AD bit
indicates that the responder has checked the data it has received and is
now forwarding on.

IMHO an AA bit outranks an AD bit.  Data with AA=1,AD=0 is reputedly coming
from *the* source (TSIG, et.al.)  Data with AA=0,AD=1 is reputedly data
that some intermediary has verified as coming from the source.  I would
assign higher credibility to AA=1,AD=0 than AA=0,AD=1.

If both AA=1 ,and AD=1, then the data is coming from a rather conservative
source.  (Which some applications may demand.)  If the setting of AD=1 is
allowed without doing crypto, some information is lost (specifically, how
conservative is the source).

(Perhaps we could Jakob to comment on this.)

>The intention was basically to stop:
>  - recursive servers from setting the AD bit on provably insecure data.
>  - authoritative servers from setting the AD bit on unsecured zones.

I think that this effort isn't strong enough then.

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                                NAI Labs
Phone: [phone]                      Email: [e-mail]

You fly too often when ... the airport taxi is on speed-dial.

Opinions expressed are property of my evil twin, not my employer.




to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.