Re: restart: Re: I-D ACTION:draft-ietf-dnsext-ad-is-secure-03.txt

[Jakob Schlyter <[e-mail]>]

On Sat, 28 Jul 2001, Edward Lewis wrote:

> IMHO an AA bit outranks an AD bit.  Data with AA=1,AD=0 is reputedly
> coming from *the* source (TSIG, et.al.)  Data with AA=0,AD=1 is
> reputedly data that some intermediary has verified as coming from the
> source.  I would assign higher credibility to AA=1,AD=0 than
> AA=0,AD=1.

an application could put trust in a dns reply by several reasons:

	reply source (i.e. who did I query)
	reply transport (i.e. tsig, tkey or nothing)
	status of some bits in the header (AA, AD, ...)

I have to configure who and how I send my query, so this is a very basic
administrative problem (except for the policy part, but let's leave that
out for the moment). the AD-bit however is harder and needs to be well
defined as applications will interpret it without knowing the verification
policy.

the reason I like the nameserver to use the AD-bit, and only the AD-bit,
to signal that the data is authenticated cryptographically is simplicity.
I do not care about whether my nameserver is authorative or not - I only
care if it has validated the data or not. it could be authorative, yet the
zonefile could be invalid (e.g. the nameserver is secondary and doesn't
fully trust source).

let us, for the people using this - not the implementators, keep this
simple. finding something to trust and communicate securely with that
entity is hard enough.

	jakob



to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.