Re: AS IF: draft-ietf-dnsext-ad-is-secure-03.txt

[Greg Hudson <[e-mail]>]

> Which sounds more secure?  2, obviously.  Until you notice that the
> key is read from disk also.

First, the reason not to set AD bits on unchecked data is not to
protected against compromised data on the server, but to detect
expired signatures.  Under your scheme, an authoritative server might
yield a different value of the AD bit than a checking recursive
resolver, and that's confusing and error-prone.

Second, you've given an argument why it might be acceptable to set AD
on non-checked responses, but do not give any motivation for doing so.
An authoritative server is probably not acting as a recursive resolver
for stub resolvers; if it is, then it needs to be prepared to do
cryptographic checking if it wants to set AD bits on out of zone data
at least.  I can't envision a realistic scenario where your scheme
adds any value.  A cryptography-free authoritative server which also
serves stub resolvers and sets AD bits but only on in-zone data?
Seems a bit of a stretch.


to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.