[DNSOP] Dnsdir last call review of draft-ietf-dnsop-rfc8109bis-05

Di Ma via Datatracker <noreply@ietf.org> Tue, 16 July 2024 07:06 UTC

MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit
From: Di Ma via Datatracker <noreply@ietf.org>
To: dnsdir@ietf.org
Auto-Submitted: auto-generated
Precedence: bulk
Message-ID: <172111361280.73300.11259378316735467523@dt-datatracker-6fbcf4599b-975km>
Date: Tue, 16 Jul 2024 00:06:52 -0700
Message-ID-Hash: L24XFZGR62WOX7CF2RKHBZHNPFDKJRG5
CC: dnsop@ietf.org, draft-ietf-dnsop-rfc8109bis.all@ietf.org, last-call@ietf.org
Reply-To: Di Ma <madi@juicybun.cn>
Subject: [DNSOP] Dnsdir last call review of draft-ietf-dnsop-rfc8109bis-05
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/TO4_8KhyD4_BqBjPhW9PeWDg9-k>

Reviewer: Di Ma
Review result: Ready with Issues

This version adds more discussions about DNSSEC to priming exchange, which I
think need clearer statements.

In this document, the authors say “With such resolvers, an attacker that
controls a rogue root server effectively controls the entire domain name space
and can view all queries and alter all unsigned data undetected.”

However, this is not true when a DNSSEC-aware resolver has been configured with
one or more Trust Anchors from some TLDs. In such case, it is not safe to say
"an attacker that controls a rogue root server effectively controls the entire
domain name space".

[DNSOP] Dnsdir last call review of draft-ietf-dns… Di Ma via Datatracker
[DNSOP] Re: [Ext] Dnsdir last call review of draf… Paul Hoffman