Re: [dnsext] Issues in WGLC of dnssec-bis-updates

On Feb 8, 2012, at 10:56 AM, Andrew Sullivan wrote:

> No hat.
> 
> On Wed, Feb 08, 2012 at 09:30:46AM +0100, W.C.A. Wijngaards wrote:
>> 
>> On 02/07/2012 08:51 PM, Mohan Parthasarathy wrote:
>> 
>>> How does it help the application to make this more fine grained ?
>> 
>> No, the application just wants all bogus data to be removed.  Data that
>> is secure and data that is not DNSSEC signed is what it wants. 
> 
> It seems to me that the above is either a matter of policy or a matter
> of implementation.  That is, some applications will surely only want
> data that they can know for sure is valid, and in particular will not
> want any unsigned data no matter what.
> 
> This could be implemented in more than one way.  One is to hand the
> application everything that is validated and unsigned, and let the
> application work out which it wants.  But another would be for the
> application to be able to signal this choice to the resolver.  No?

In specific, the current proposal for DANE wants to know if it is getting bogus data. It treats bogus data as quite different than "no record received". See the bulleted list in section 5 of draft-ietf-dane-protocol-16.txt.

If the DNSEXT WG thinks that it is going to change dnssec-bis to make the change Wouter suggests, the DANE WG needs to hear about it *very soon*.

--Paul Hoffman

_______________________________________________
dnsext mailing list
dnsext@ietf.org
https://www.ietf.org/mailman/listinfo/dnsext