[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [dnssec-deployment] some observations about .SE's DNSSEC


Colleagues,
Below is a mail from Mats Sufberg, its part of a thread on the DNSSEC deployment list (http://mail.shinkuro.com:8100/Lists/dnssec- deployment/).
The background to this story is that a popular implementation started shipping code that sets the AD bit on validated responses even though the DO bit was not set on the query. These answers are getting stuck in the filters of popular DSL modems. The result being that data from secured zones would not be resolved.
The case is made that when there is a trust relation between the stub resolver and the validating nameserver you do not need to have all the DNSSEC information that you receive when you set the DO bit. On the other hand it was observed that a resolving nameserver should not just set bits in query headers without being instructed to do so.
The suggestion is that the AD bit is used in the query to signal the readiness to deal with AD bits in the answer.
I think its a fine idea and would support such text in draft-ietf- dnsext-dnssec-bis-updates. 

If folk think this needs an I-D then I'd be willing to edit it.

--Olaf



On 27Sep 2007, at 9:51 AM, <Mats.Dufberg@teliasonera.com> wrote:


From: DNSSEC deployment
[mailto:dnssec-deployment@shinkuro.com] On Behalf Of Mark Andrews
Sent: den 27 september 2007 08:48

(...)

On 27 sep 2007, at 00.41, Mark Andrews wrote:


	As AD is only supposed to be used where you trust the server
	could we use AD itself to signal that we want AD to be set in
	the response when DO is not set.


if you can set AD, why not set DO and just ignore the

signatures in

the response? that's how we do it in the stand-alone

implementation

of getrrsetbyname() used by OpenSSH-portable.

	jakob


	Why ask for more than you need?


Either of the two solutions would probably work. The lesson we should
learn from the broadband router problem is that a DNSsec enhanced
nameserver (resolving or hosting) should behave just like a non-DNSsec
nameserver unless being asked to include DNSsec information.

The AD flag in query has no other meaning and could be interpreted as
"Authentication check Desired".








-----------------------------------------------------------
Olaf M. Kolkman
NLnet Labs
http://www.nlnetlabs.nl/

Attachment: PGP.sig
Description: This is a digitally signed message part