Re: [DNSOP] Definition of "trust anchor"

[Petr Špaček <[e-mail]>]

On 26.3.2018 12:17, George Michaelson wrote:
> This doesn't seem a good fit for the PKI definition of a TA.
> 
> You can have several TA. any are sufficient to define a trust point to
> anchor validation. you don't care which.
> 
> how the path is built, is not the same as where it terminates. top
> down or bottom up is legal in PKI.

I propose to keep the citation as is and add clarifying sentence:

"This definition does not prescribe way how implementation of DNSSEC
validation builds authentication chain."

Petr Špaček  @  CZ.NIC

> 
> -G
> 
> On Sun, Mar 25, 2018 at 8:21 PM, Paul Hoffman <[e-mail]> wrote:
>> The current text is:
>>
>> "A configured DNSKEY RR or DS RR hash of a DNSKEY RR.  A
>> validating security-aware resolver uses this public key or hash as
>> a starting point for building the authentication chain to a signed
>> DNS response." (Quoted from <xref target="RFC4033"/>, Section 2)
>>
>> The WG has has a preference for quoting from RFCs, but there was also some
>> hesitation about this. How would people change this, possibly updating RFC
>> 4033?
>>
>> --Paul Hoffman