Re: [dnsext] WGLC: draft-ietf-dnsext-dnssec-bis-updates-16

[Samuel Weiler <[e-mail]>]

Most of the WGLC comments in this thread were addressed in Andrew's 
"issues" thread and are addressed, in some form, in the forthcoming 
-17.  I'm trying to catch any others.


On Fri, 20 Jan 2012, Edward Lewis wrote:

> In 2005 it was too soon to publish, now it is not.  And at this point there 
> may be more and more wrinkles in the DNSSEC specs, but we need to get out at 
> least this (first) update.

Thank you.

> Pressence has a presence in the document.  It shouldn't (the spelling, I 
> mean).

Fixed (and thanks to the others who also caught this).

> 5.9's title is misleading.  The content is good, it's about answering from 
> cache in the face of a CD query.  But "always doing CD" only applies to 
> elements that will do their own validation.

Doesn't it also apply to a non-validating box in the middle?  That box 
may still need to return +CD data if something downstream wants it.

The only place I see it not applying is stub resolvers.  Rather than 
alter the title (since I couldn't think of a good way to do it), I 
propose adding a paragraph saying "this doesn't apply to stub 
resolvers".

> 5.4 could optionally make the point that a validator that expects all 
> signatures to be good and/or all chains to work is vulnerable to malicious 
> insertions of gibberish-based signatures.  It's harder to construct a good 
> chain than a false chain.

Added a line.

-- Sam