Subject: DNSSEC backward compatibility

From: Sarah Ahmed <[email-masked]>
Date: Tue, 13 Jul 1999 11:29:06 EDT

Hi,

Is TIS/DNSSEC backward compatible with non-security aware name-servers? If it 
is, then how does a security aware resolver know whether the name-server it 
contacts is security aware or not and vice-versa ( i.e. how does a security 
aware server know whether the client it is being queried by is security aware 
or not? ) What is the difference in the format of the request or response 
to/from a security-aware client/server and a non-security aware one?

-------------------------------------------------------------------------

Sarah Ahmed					Ph#  (617)-225-8607 
Mass Inst of Tech                               email : [email-masked] 
Rm#527 , McCormick Hall
320 Memorial Drive 
Cambridge , MA - 02139

---

From: Brian Wellington <[email-masked]>
Date: Tue, 13 Jul 1999 15:18:28 -0400 (EDT)

> to/from a security-aware client/server and a non-security aware one?

TIS/DNSSEC is not supported anymore.  DNSSEC is currently being
incorporated into BIND - BIND 8.2.1 contains a subset of DNSSEC, and BIND
9 will include a full implementation.

A security-aware resolver may trust its local nameserver, in which case it
would issue a query that looks identical to a non-security-aware
resolver's query.  It would, though, expect the AD (authenticated data)
bit set in the response.  Transaction security should be used in this
case to prevent malicious tampering over the local link.

A security-aware resolver may also issue a query with the CD (checking
disabled) bit set, which would instrust the local name server to forgo any
authentication checks. The resolver would then perform the security checks
itself.

A security-aware server will always include SIG records corresponding to
each resource record set returned, and may return KEY records in the
additional section if there is room in the packet.  NXT records will be 
returned to signify nonexistent records (this is not implemented in
BIND 8.x).  The AD bit will be set if all answers can be verified.

Brian

---

From: Edward Lewis <[email-masked]>
Date: Wed, 14 Jul 1999 05:13:03 -0400

The answer is yes - DNSSEC is backwards compatible with non-DNSSEC servers.
Brian's comments are right about BIND versions - use the latest BIND.

The critical operation to backwards compatibility is whether a secure
resolver get secured data from a remote secured zone via an unsecured
recursive server.  The answer is yes.  The reason is that the recursive
(and cacheing) server may only return unsigned data on the first query -
the secured resolver can ask for SIG records on a second try.  The
unsecured resolver would pass SIG records as an opaque type - it wouldn't
(if this is an older BIND) cache them.

>to/from a security-aware client/server and a non-security aware one?

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                                NAI Labs
Phone: +1 443-259-2352                      Email: [email-masked]

"Trying is the first step to failure." - Homer Simpson
"No! Try not. Do... or do not. There is no try." - Yoda

Opinions expressed are property of my evil twin, not my employer.