Re: [DNSOP] [Int-area] Review request- DNS Secure authentication

["Hosnieh Rafiee" <[e-mail]>]

Hi Roland,

Thanks a lot for your comments. 

> No, IMHO it is not. Usually you need clear attacker models to explain
existing
> vulnerabilities. The current problem statement is quite a mixup of various
> different security aspects and thus not clear.
> 
> Just a few examples:
> "DNS records can become compromised." => this is an attack on the
> _integrity_, but it can be launched at different locations and at
different levels
> (e.g., in the DNS databased, with the DNS server, on the wire in transit,
etc.)

This is true. Do you think it is enough only I add briefly the level of
protection in parenthesis and for more information probably I use RFC 3833
as a reference? 

I also have a section at the end (section 9) that explains the protection
level in more detail. In first versions, I had this section in problem
statement but I removed it due to the fact that some reviewers thought that
I haven't yet explained about CGA-TSIG algorithm and explaining its
protection level does not make sense.  This was the case I moved it to the
end of the document and in problem statement I only left a brief explanation
of different mechanisms.

So if this is wrong. What do you suggest as a best organization?

Thanks,
Best,
Hosnieh.