Re: [keyassure] I-D Action:draft-ietf-dane-protocol-04.txt

[Stephen Kent <[e-mail]>]

At 3:12 PM +0000 2/25/11, Ben Laurie wrote:
>...
>  > if you issue a cert, you are a CA
>
>Eh? If I make a self-signed cert, am I a CA?

yes.

>If I publish an EE cert issued by someone else, am I a CA?

no. publishing is not the same as issuing. any 3rd party can publish any cert.

>Presumably at least one of these is a "no", so the zone operator is
>not necessarily a CA. This was my point.

OK.

>...
>  > It would not be useful to you, but rather to someone who puts it in a
>>  DNS record, if that someone does so on your behalf. Otherwise that entity
>>  does not know if the public key really is yours.  But, I don't know that
>>  this results in a vulnerability for the DANE context.
>
>Ah. If I am asking someone else to update DNS for me, then indeed a
>PoP might be appropriate. But surely that's an issue for whatever
>protocol I am using for speaking with my DNS provider?

seems reasonable to me.

Steve