Re: Question about TSIG, AD/AA, and AXFR

[Yuji Kamite <[e-mail]>]

On Tue, 17 Jul 2001 13:39:58 -0700
Edward Lewis <[e-mail]> wrote:

> Host should "trust" answers that pass the TSIG test and have either AA or
> AD.  Answers with TSIG and neither ought to be used as "as best as can be
> gotten, but obviously unreliable."  I think a good question is what is the
> interaction of the "gimme DNSSEC records" bit, the AA bit, and validity
> period checking.  If the authoritative server does not check the validity
> period, and the SIGs aren't sent, then the stub might accept temporally
> invalid data.

I have a question about AD and "gimme DNSSEC records".
Is it allowed to return responses with AD bit even if
they do not include SIG, NXT and so on?
I'm a little confused with usage of AD because the
definition about AD in documents seems to be obscure, especially
about when it must be set.

For example, in BIND9 implementaition, recursive resolver
seems to set AD flag in answer if given query has "gimme DNSSEC records" bit.
It does not set AD unless given query has "gimme DNSSEC records" bit
even when the RRs themselves are Authenticated by the server.
Is this right behavior?

I think it might be okay for the recursive resolver to
reply AD-set answer without DNSSEC-related RRs, if the RRs have been
authenticated (i.e. if the server has succeeded to verified
the RRs' SIGs according to trust chains) and the message to the
stub-resolver are protected by TSIG.

>From the view of the host (stub-resolver) which asked the recursive
resolver, it would like to trust all tasks of the resolver by means of
adding TSIG into queries. But it depends totally on the stub-resolver
whether it will send queries with "gimme DNSSEC records" bit.
Stub-resolver may send query without "gimme DNSSEC records" bit,
if it wants to restrict the packet size exchaged.

In this case, queries and responses between stub-resolver
and recursive resolver are protected by TSIG, so,
I think only if the answer's AD can be set, stub-resolvers might be
able to trust aquired RRs' validity.

--
Yuji Kamite
Information Technology Center, Univ. of Tokyo
E-Mail: [e-mail]





to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.