Re: I-D ACTION:draft-ietf-dnsext-ad-is-secure-02.txt

[Edward Lewis <[e-mail]>]

Ref. section 2, the term "Authenticated" is used.  I think you mean to say
that the data has been verified via a temporally and cryptographically
verified chain of trust back to a configured key.  Authenticated is too
broad a term, so you need to qualify it in this context or redefine it.
Even if this is done in another document, you should reference that more
explicitly.

Now, for a open question.  Authenitcated data presumably means that the
chain was built according to some policy - e.g., RFC 300x.  What will
happen when the authenticating server uses a policy that is not strong
enough for the resolver?  Will there be a way to indicate the policy used?
(This is also a question to folks wanting to research off-tree validation.)

Finally - should it be more explicit that data in the additional section is
not (never) checked?  Is there a reason to always omit signatures from the
additional section in this case?  (Why provide them if they've been
ignored?)

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                                NAI Labs
Phone: [phone]                      Email: [e-mail]

You fly too often when ... the airport taxi is on speed-dial.

Opinions expressed are property of my evil twin, not my employer.




to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.