Re: Question about TSIG, AD/AA, and AXFR

[Robert Elz <[e-mail]>]

    Date:        Mon, 16 Jul 2001 16:43:44 -0700
    From:        Edward Lewis <[e-mail]>
    Message-ID:  <[e-mail]>

  | I am wondering if there is an unreported protocol problem in the
  | combination of TSIG, AD/AA, and AXFR.

This isn't  protocol problem, it is operational.   Using just the protocol
you have no way to determine the source of the data for AXFR at all, only
that it exists, and is being made available to you (and then the rules for
making sense of it all of course).

If you don't trust the server you're configured to obtain the data from to
send you accurate data, then you should be getting it from elsewhere.
All TSIG helps you do is rest assured that the data has truly been sent
to you from the server you configured to send it.

For anything more than this (knowing that the data is the correct data)
you really need to be using dnssec, and verifying all those signatures.

  | DNS Security is supposed to be about protecting the resolver,

But that's not what TSIG is about, I don't think (except when it is being
used to enable secure communications between a stub resolver and a back
end resolver/cache).

TSIG is just the cheap mechanism to get data that is secured via some other
means to a node that doesn't want to implement the full security model.
If the data wasn't already known to be secure, there's nothing TSIG can
possibly do to assist.

kre



to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.