Re: [dnsext] WGLC: draft-ietf-dnsext-dnssec-bis-updates-16

In message <CACU5sD=P-agE2oOqvAiCs=bcX3Off6cCubW-f=skKP54-1oQaQ@mail.gmail.com>
, Mohan Parthasarathy writes:
> On Fri, Jan 27, 2012 at 9:20 PM, Mark Andrews <marka@isc.org> wrote:
> >
> > In message <CACU5sDnS-3V26yKyvTGObR67H2LPiBjWxCZAbMpHPZrgXJeNFg@mail.gmai=
> l.com>
> > , Mohan Parthasarathy writes:
> >
> >> - Section 5.7 setting the AD bit on queries. Is CD=0,DO=0 in the que=
> ry
> >> same as AD=1,DO=0 ?
> >
> > The question doesn't make sense.
> >
> > AD=0,DO=1 and AD=1,DO=1 produce the same result.
> > AD=0,DO=0 and AD=1,DO=0 produce different results.
> > AD=0,DO=0 and AD=0,DO=1 produce different results.
> > AD=1,DO=0 and AD=0,DO=1 produce different results.
> >
> Thanks for the clarification. I realized after I posted that not
> setting CD and DO is pre-DNSSEC.
> 
> >> missed the discussion on this earlier. If there is a valid reason,
> >> that needs to be stated explicitly as to why we are introducing this
> >> new option.
> >
> > Section 5.7 explains why this option exists.
> >
> >                This allows a requestor to indicate that i=
> t understands
> >   the AD bit without also requesting DNSSEC data via the DO bit.
> >
> >
> So, "understands" here means "Please do the validation for me " ?
> Then, is  CD=1, AD=1 a invalid option ?

No.  AD will be 1 if the answer + authority sections come from
cached data that has validated as secure.  That said I don't think
there is much use unless you are trying to check if a lookup failure
was due to DNSSEC errors.

> So, there are implementations out there that want to know whether
> validation was successful or not but just not want to handle any
> DNSSEC records?

I will put it this way.  I doubt if there is a application that
cares about AD that *wants* the DNSSEC records.  At the moment they
have no choice unless they are using the draft.

> My question was more on what prompted the addition of this new feature ?

1. It reduces the response size.
2. You can apply DNS64, NXDOMAIN redirection, bad site filtering, etc. with
   AD=1 which you can't with DO=1.

Mark
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: marka@isc.org
_______________________________________________
dnsext mailing list
dnsext@ietf.org
https://www.ietf.org/mailman/listinfo/dnsext