Re: [dnsext] WGLC: draft-ietf-dnsext-dnssec-bis-updates-16

[Mark Andrews <[e-mail]>]

	5.9.  Always set the CD bit on Queries  

	This is demonstratively *bad* advice.  The discussion to do
	with always setting CD bit on queries centered around
	different sets of trust anchors.

	If you take two validating recursive server in series with
	the *same* trust anchors.  If you always set CD then the
	downstream server is vulnerable to a accidental denial of
	service attack if any of the authoritative servers for the
	zone is returning stale (will fail validation) data.

		C -> VR1 -> VR2 -> {A1, A2, A3 .... AN }

	VR1 should make CD=0 as it has no control over which of A1
	... AN, VR2 queries.  By making a CD=0 query, VR2 will
	filter out responses from the stale server.  If the response
	from VR2 to the CD=0 is SERVFAIL then VR1 it should make a
	CD=1 query in case there is a mis-configured trust anchor
	or bad clock.

	Yes, Andrew it is re-opening this subject.

	Mark
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: [phone]                 INTERNET: [e-mail]