Subject: [DNSOP] Terminology: validating resolver

From: "Paul Hoffman" <[email-masked]>
Date: Mon, 02 Apr 2018 16:45:42 -0700

Some folks didn't feel all that great about this because it's not 
defined in an RFC. Specific suggestions welcome.

Validating resolver:
   A security-aware recursive name server, security-aware resolver, or
   security-aware stub resolver that is applying at least one of the
   definitions of validation (above), as appropriate to the resolution
   context.  For the same reason that the generic term "resolver" is
   sometimes ambiguous and needs to be evaluated in context,
   "validating resolver" is a context-sensitive term.

---

From: George Michaelson <[email-masked]>
Date: Tue, 3 Apr 2018 00:05:27 +0000

RFC4035 section 3.2 looks like it has usable words surely?

not from those words, but in my personal opinion, Any resolver which
is able to understand and apply the semantic context of DNSSEC
signatures over RR should be considered a validating resolver.
However, a validating resolver may also be seen NOT to perform
validation because it receives queries with the CD bit set. Therefore,
you cannot say that all queries through a validating resolver
necessarily demonstrate it is capable of validating. Its not entirely
subject to external views of its behaviour without the full context of
what was in the query received.

-G

On Mon, Apr 2, 2018 at 11:45 PM, Paul Hoffman <[email-masked]> wrote:
> Some folks didn't feel all that great about this because it's not defined in
> an RFC. Specific suggestions welcome.
>
> Validating resolver:
> _______________________________________________
> DNSOP mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dnsop

---

From: "Paul Hoffman" <[email-masked]>
Date: Mon, 02 Apr 2018 17:13:29 -0700

> RFC4035 section 3.2 looks like it has usable words surely?

Maybe I'm an idiot, but I see no definition of "validating resolver" 
there.

> what was in the query received.

Errr, could you give that specific words that you would want to replace 
the current definition?

--Paul Hoffman

---

From: George Michaelson <[email-masked]>
Date: Tue, 3 Apr 2018 00:21:37 +0000

On Tue, Apr 3, 2018 at 12:13 AM, Paul Hoffman <[email-masked]> wrote:
> Maybe I'm an idiot, but I see no definition of "validating resolver" there.

ok. So what is the 'resolver side' of a 'security aware' nameserver in
3.2, 3.2.1, 3.2.2, 3.2.3 and 4?

You're not an idiot. I make many inferential leaps which aren't
subsequently justified, but it felt to me like the definitional
language around security aware went to validation.

> Errr, could you give that specific words that you would want to replace the
> current definition?

I think we're a bit of a way off that stage Paul. If you don't think
its defined in an RFC, we're "inventing things" and I always feel very
nervous about that.

-G