[dhcwg] Re: WG last call on draft-ietf-dhc-dhcpv6-opt-dnsconfig-02.txt

In response to the main question: I've read the draft, the option
looks looks reasonable to me (subject to the discussion that has
already taken place during this last call, I'm not disagreeing with
any of that), and I think it'd be useful for this draft to advance.

The rest of this message is on one specific point:

At Thu, 20 Feb 2003 14:55:11 -0500, Ralph Droms wrote:
> At 08:27 PM 2/10/2003 +0100, Peter Koch wrote:
> 
> >Apart from the sad fact that DNSSEC isn't yet deployed I don't see why it
> >wouldn't be able to detect spoofing. If, however, you want to say that
> >using domain names in the search list you don't control is a dangerous
> >thing, that could be emphazised by a reference to RFC 1535.
> 
> The idea here (note that I'm not a DNSSEC expert, either) is that
> a search list that the host doesn't control might still pass DNSSEC
> authentication while yielding unexpected results.
> 
> I would be happy to hear that DNSSEC can prevent the problem and would
> be willing to follow your suggestion and replace the reference to
> DNSSEC with a more general reference to untrusted search lists.

DNSSEC could let you figure out whether the data you got back was
signed by an entity which you trust.  The difficulty with search
paths, is that you're also trusting the search path to tell you what
question you should be asking.  So DNSSEC could let you figure out
whether the random question that your search path just told you to ask
was answered with data signed by an entity which you trust, but it's
not going to help you figure out whether that was the right question.
_______________________________________________
dhcwg mailing list
dhcwg@ietf.org
https://www1.ietf.org/mailman/listinfo/dhcwg