Re: Question about TSIG, AD/AA, and AXFR

[Edward Lewis <[e-mail]>]

It is true DNSSEC can't guarantee that data is correct nor correctly
handled, but at least it will help point out where the fault is.  Perhaps
I've been assuming "trustworthy" with being able to trace the data back to
the (appropriate) source.

>From you message it sounds like no one should trust data with the AA bit,
as this means the authentication has not been checked.  This is an ironic
conclusion, as we've been assigning more credibility to AA'd data.  (Once
again, the credibility vs. authenticated issue arises.)

At 3:31 AM -0400 7/17/01, Jakob Schlyter wrote:
>On Mon, 16 Jul 2001, Edward Lewis wrote:
>
>> Case TSIG AD AA Server-type
>>   1    Y   0  1 Primary        "From disk," so it can be trusted
>>   2    Y   0  1 Secondary      Via AXFR, trustworthy only if AXFR is secure
>
>why can the data be trusted just because the server read it from disk or
>safely AXFRed? a lot of bad things could have happen to the data between
>signing och loading, especially if you're doing off-line signing.
>
> - the signatures could have expired
> - the signatures could not be valid yet
> - someone could maliciously have inserted or altered data
> - data could be corrupted by other means
>
>
>	jakob


-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                                NAI Labs
Phone: [phone]                      Email: [e-mail]

You fly too often when ... the airport taxi is on speed-dial.

Opinions expressed are property of my evil twin, not my employer.




to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.