Re: [dnsext] WGLC: draft-ietf-dnsext-dnssec-bis-updates-16

[Edward Lewis <[e-mail]>]

Comments.

In 2005 it was too soon to publish, now it is not.  And at this point 
there may be more and more wrinkles in the DNSSEC specs, but we need 
to get out at least this (first) update.

Some comments:

Pressence has a presence in the document.  It shouldn't (the spelling, I mean).

5.9's title is misleading.  The content is good, it's about answering 
from cache in the face of a CD query.  But "always doing CD" only 
applies to elements that will do their own validation.

5.4 could optionally make the point that a validator that expects all 
signatures to be good and/or all chains to work is vulnerable to 
malicious insertions of gibberish-based signatures.  It's harder to 
construct a good chain than a false chain.
-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis
NeuStar                    You can leave a voice message at [phone]

Vote for the word of the day:
"Papa"razzi - father that constantly takes photos of the baby
Corpureaucracy - The institution of corporate "red tape"