Re: [dnsext] AD bit

[Alfred Hönes <[e-mail]>]

At Mon, 05 Mar 2012 09:11:52 +1100, Mark Andrews wrote:
> In message <20120304205347.GA17454 at miek.nl>, Miek Gieben writes:
>> Hello,
>>
>> As RFC 4035 obsoletes both RFC 3655 and RFC 2535, what document should
>> be used to find the definition of the AD and CD bits in the message header?
>>
>>  Regards,
>>
>> --
>>     Miek Gieben
>
> Currently RFC 2535.

I don't think so.

RFCs 4033 and 4035 have obsoleted RFCs 2535 and 3655.  We should
not give citations of obsolete documents as normative sources.

And we _do_ have such sources in this case:

Section 3 of RFC 4033 says (emphasis added):

|3.  Services Provided by DNS Security
|
|  The Domain Name System (DNS) security extensions provide origin
|  authentication and integrity assurance services for DNS data,
|  including mechanisms for authenticated denial of existence of DNS
|  data.  These mechanisms are described below.
|
|> These mechanisms require changes to the DNS protocol.  DNSSEC adds
|  four new resource record types: Resource Record Signature (RRSIG),
|  DNS Public Key (DNSKEY), Delegation Signer (DS), and Next Secure
|> (NSEC).  It also adds two new message header bits: Checking Disabled
|> (CD) and Authenticated Data (AD).  In order to support the larger DNS
|  message sizes that result from adding the DNSSEC RRs, DNSSEC also
|  requires EDNS0 support ([RFC2671]).  Finally, DNSSEC requires support
|  for the DNSSEC OK (DO) EDNS header bit ([RFC3225]) so that a
|  security-aware resolver can indicate in its queries that it wishes to
|  receive DNSSEC RRs in response messages.
|
|  [...]

RFCs 4033-4035 (+ some more) are the current DNSSEC specifications,
and this should make clear that this document set is authoritative
for these bits now.

RFC 4035 contains copious text in multiple sections specifying the
AD and CD bits, in particular Sections 3.1.6, 3.2.2, 3.2.3, 4.6,
4.9.2, 4.9.3.  Furthermore, RFC 4035 contains (emphasis added):

|6.  IANA Considerations
|
|  [RFC4034] contains a review of the IANA considerations introduced by
|  DNSSEC.  The following are additional IANA considerations discussed
|  in this document:
|
|> [RFC2535] reserved the CD and AD bits in the message header.  The
|> meaning of the AD bit was redefined in [RFC3655], and the meaning of
|> both the CD and AD bit are restated in this document.  No new bits in
|> the DNS message header are defined in this document.
|
|  [...]

I guess this qualifies for quoting RFC 4035 (or RFCs 4033 and 4035)
as the authoritative definition of these bits.

The IANA assigned placement information for both bits has been
maintained in RFC 6195 and its predecessors as well.

Kind regards,
  Alfred.

-- 

+------------------------+--------------------------------------------+
| TR-Sys Alfred Hoenes   |  Alfred Hoenes   Dipl.-Math., Dipl.-Phys.  |
| Gerlinger Strasse 12   |  Phone: [phone], Fax: -18         |
| D-71254  Ditzingen     |  E-Mail:  [e-mail]                     |
+------------------------+--------------------------------------------+

_______________________________________________
dnsext mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/dnsext