Re: [dnsext] Reminder: two WGLC closing in one week

[Michael StJohns <[e-mail]>]

At 02:18 AM 9/23/2008, Mark Andrews wrote:
>        No, it is NOT unkown.  It is insecure.  You are attempting to introduce
>        a state which does not exist.
>
>        secure -> passes validation
>        insecure -> no TA or there is a insecure delegation from a secure zone.
>        bogus -> fails validation

 From 4035...

   Secure: An RRset for which the resolver is able to build a chain of
      signed DNSKEY and DS RRs from a trusted security anchor to the
      RRset.  In this case, the RRset should be signed and is subject to
      signature validation, as described above.

   Insecure: An RRset for which the resolver knows that it has no chain
      of signed DNSKEY and DS RRs from any trusted starting point to the
      RRset.  This can occur when the target RRset lies in an unsigned
      zone or in a descendent of an unsigned zone.  In this case, the
      RRset may or may not be signed, but the resolver will not be able
      to verify the signature.





Arends, et al.              Standards Track                    [Page 20]

RFC 4035             DNSSEC Protocol Modifications            March 2005


   Bogus: An RRset for which the resolver believes that it ought to be
      able to establish a chain of trust but for which it is unable to
      do so, either due to signatures that for some reason fail to
      validate or due to missing data that the relevant DNSSEC RRs
      indicate should be present.  This case may indicate an attack but
      may also indicate a configuration error or some form of data
      corruption.

   Indeterminate: An RRset for which the resolver is not able to
      determine whether the RRset should be signed, as the resolver is
      not able to obtain the necessary DNSSEC RRs.  This can occur when
      the security-aware resolver is not able to contact security-aware
      name servers for the relevant zones.