Re: [dnsext] Issues in WGLC of dnssec-bis-updates

Eric Brunner-Williams <ebw@abenaki.wabanaki.net> Wed, 08 February 2012 14:48 UTC

Message-ID: <4F328B16.7030006@abenaki.wabanaki.net>
Date: Wed, 08 Feb 2012 09:47:50 -0500
From: Eric Brunner-Williams <ebw@abenaki.wabanaki.net>
Organization: wampumpeag
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.5; rv:9.0) Gecko/20111222 Thunderbird/9.0.1
MIME-Version: 1.0
To: dnsext@ietf.org
References: <20120207151820.GE9478@crankycanuck.ca> <4F31449C.9040604@nlnetlabs.nl> <20120208123202.GC25766@vacation.karoshi.com.>
In-Reply-To: <20120208123202.GC25766@vacation.karoshi.com.>
Subject: Re: [dnsext] Issues in WGLC of dnssec-bis-updates
Precedence: list
Reply-To: ebw@abenaki.wabanaki.net
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: dnsext-bounces@ietf.org
Errors-To: dnsext-bounces@ietf.org

On 2/8/12 7:32 AM, bmanning@vacation.karoshi.com wrote:
>> I feel the first (4033) is a better description.  I personally use adefinition for this as: this portion of the tree does not have a trustanchor above it (higher up the hierarchy), and therefore is not secure,insecure, or bogus.  Note that with the root trust anchor theindeterminate state no longer occurs, since we know everything iscovered by that trust anchor.
> 	Which root?  The ICANN root?  My corporate root?
> 	Folks use IP and DNS in networks that may not be connected to the 
> 	"public" Internet and thus to the ICANN root key.

Futher, there exists one or more networks connected to the "public"
Internet (non-locally routed prefixes) for which the IANA root zone
does not completely determine the root zone, and for which one or more
zone-restricted trust anchors would be insufficient.

> 	So I would say that there is existence proof that you can find 
> 	the ICANN root trust anchor in an indeterminate state.

Agree.

Eric
_______________________________________________
dnsext mailing list
dnsext@ietf.org
https://www.ietf.org/mailman/listinfo/dnsext

Re: [dnsext] Issues in WGLC of dnssec-bis-updates W.C.A. Wijngaards
[dnsext] Issues in WGLC of dnssec-bis-updates Andrew Sullivan
Re: [dnsext] Issues in WGLC of dnssec-bis-updates W.C.A. Wijngaards
Re: [dnsext] Issues in WGLC of dnssec-bis-updates Andrew Sullivan
Re: [dnsext] Issues in WGLC of dnssec-bis-updates W.C.A. Wijngaards
Re: [dnsext] Issues in WGLC of dnssec-bis-updates Edward Lewis
[dnsext] What is indeterminate Paul Hoffman
Re: [dnsext] Issues in WGLC of dnssec-bis-updates Mohan Parthasarathy
Re: [dnsext] Issues in WGLC of dnssec-bis-updates Mark Andrews
Re: [dnsext] What is indeterminate Mark Andrews
Re: [dnsext] What is indeterminate Paul Hoffman
Re: [dnsext] Issues in WGLC of dnssec-bis-updates W.C.A. Wijngaards
Re: [dnsext] Issues in WGLC of dnssec-bis-updates Mark Andrews
Re: [dnsext] Issues in WGLC of dnssec-bis-updates bmanning
Re: [dnsext] Issues in WGLC of dnssec-bis-updates Eric Brunner-Williams
Re: [dnsext] Issues in WGLC of dnssec-bis-updates Mohan Parthasarathy
Re: [dnsext] Issues in WGLC of dnssec-bis-updates Andrew Sullivan
Re: [dnsext] Issues in WGLC of dnssec-bis-updates Paul Hoffman
Re: [dnsext] Issues in WGLC of dnssec-bis-updates Mark Andrews
Re: [dnsext] Issues in WGLC of dnssec-bis-updates Mohan Parthasarathy
Re: [dnsext] Issues in WGLC of dnssec-bis-updates Edward Lewis
Re: [dnsext] Issues in WGLC of dnssec-bis-updates Mark Andrews
Re: [dnsext] Issues in WGLC of dnssec-bis-updates Mohan Parthasarathy
Re: [dnsext] Issues in WGLC of dnssec-bis-updates W.C.A. Wijngaards
Re: [dnsext] Issues in WGLC of dnssec-bis-updates Andrew Sullivan
Re: [dnsext] Issues in WGLC of dnssec-bis-updates Samuel Weiler
Re: [dnsext] Issues in WGLC of dnssec-bis-updates Paul Hoffman
Re: [dnsext] Issues in WGLC of dnssec-bis-updates Andrew Sullivan
Re: [dnsext] Issues in WGLC of dnssec-bis-updates Paul Hoffman
Re: [dnsext] Issues in WGLC of dnssec-bis-updates Wes Hardaker