Re: [dnsext] Reminder: two WGLC closing in one week

[Mark Andrews <[e-mail]>]

In message <[e-mail]>, Michael StJohns writes:
> --=====================_638747484==.ALT
> Content-Type: text/plain; charset="us-ascii"
> 
> At 02:18 AM 9/23/2008, Mark Andrews wrote:
> >        No, it is NOT unkown.  It is insecure.  You are attempting to introd
> uce
> >        a state which does not exist.
> >
> >        secure -> passes validation
> >        insecure -> no TA or there is a insecure delegation from a secure zo
> ne.
> >        bogus -> fails validation
> 
>  From 4035...
> 
>    Secure: An RRset for which the resolver is able to build a chain of
>       signed DNSKEY and DS RRs from a trusted security anchor to the
>       RRset.  In this case, the RRset should be signed and is subject to
>       signature validation, as described above.
> 
>    Insecure: An RRset for which the resolver knows that it has no chain
>       of signed DNSKEY and DS RRs from any trusted starting point to the
>       RRset.  This can occur when the target RRset lies in an unsigned
>       zone or in a descendent of an unsigned zone.  In this case, the
>       RRset may or may not be signed, but the resolver will not be able
>       to verify the signature.

	If there is no trust anchor then the answer is insecure.

	"The resolver knows that it has no chain of signed DNSKEY
	 and DS RRs from any trusted starting point to the RRset."

>    Bogus: An RRset for which the resolver believes that it ought to be
>       able to establish a chain of trust but for which it is unable to
>       do so, either due to signatures that for some reason fail to
>       validate or due to missing data that the relevant DNSSEC RRs
>       indicate should be present.  This case may indicate an attack but
>       may also indicate a configuration error or some form of data
>       corruption.
> 
>    Indeterminate: An RRset for which the resolver is not able to
>       determine whether the RRset should be signed, as the resolver is
>       not able to obtain the necessary DNSSEC RRs.  This can occur when
>       the security-aware resolver is not able to contact security-aware
>       name servers for the relevant zones.

	Which is *not* what you were calling unknown.

	Mark

-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: [phone]                 INTERNET: [e-mail]

--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>