Subject: Re: IESG feedback on dnsext-ad-is-secure

From: Jakob Schlyter <[email-masked]>
Date: Tue, 11 Jun 2002 11:20:04 +0200 (MEST)

On Tue, 11 Jun 2002, Erik Nordmark wrote:

> Do applications today have an API by which they get "security status"
> from a local, full DNSsec resolver?

yes, using getrrsetbyname(3): "The RRSET_VALIDATED flag in rri_flags is
set if the AD (autenticated data) bit in the DNS answer is set. This flag
should not be trusted unless the transport between the nameserver and the
resolver is secure (e.g. IPsec, trusted network, loopback communication)."

> How do applications use that information?

the applications we have written use this information to put additional
trust into certificates validated by a local resolver.

> Does such local information consist of just one bit? Or the ability to
> discover more information about the "security status" of the response?

it is currently one bit only since it is only based on ad. more
information would be useful, but one bit is a huge step compared to
nothing.

	jakob

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Greg Hudson <[email-masked]>
Date: 11 Jun 2002 13:30:35 -0400

[ post by non-subscriber.  with the massive amount of spam, it is easy to
  miss and therefore delete mis-posts.  so fix subscription addresses! ]

I am not personally aware of applications which want to know the
signedness of a DNS record, but it does seem like a reasonable thing to
want.  I'll leave it up to others (like the draft authors) to provide
more concrete details.

On Tue, 2002-06-11 at 03:27, Erik Nordmark wrote:
> > There is one common case where that trust is perfectly justified: the
> > recursive resolver runs on the same machine as the application.

> But in that case, isn't this an API question more than a protocol question?

Uh, just because the recursive resolver is running on the same machine
doesn't mean that the application is magically using some rich, RPC-like
interface to talk to it.  The stub resolver still communicates with the
recursive resolver using the DNS protocol, just as if it were on a
different host.

So it's still a protocol question.

> I could speculate that in this case a richer interface might make sense

Possibly, but it would be a lot of work to design this richer interface,
no one has a proposal on the table, and AD-is-secure does not damage our
ability to achieve a richer interface in the future.