Re: [dnsext] Clarifying the mandatory algorithm rules

[Edward Lewis <[e-mail]>]

At 12:09 -0300 3/14/11, Brian Dickson wrote:

>While technically correct, I think there is a holistic concern.
>
>All who use DNSSEC, have a vested interest in ensuring that it is, on
>the whole, as secure as possible.

The goal is not "as secure as possible."  Begin with DNS as it was 
defined before DNSSEC. It emphasized speed, reliability, and most 
importantly scaleable management.   DNSSEC came along to address the 
architectural vulnerability of the need for caches.  DNSSEC's target 
was to lower the gullable nature of the architecture while having as 
little impact on the original DNS as possible.

Security is never the end goal.  It is a means to an end.  The end, 
in the DNS service model, is the delivery of the answer given a 
question.
-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis
NeuStar                    You can leave a voice message at [phone]

Me to infant son: "Waah! Waah! Is that all you can say?  Waah?"
Son: "Waah!"