Re: [dnsext] Issues in WGLC of dnssec-bis-updates

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi Paul, Andrew,

On 02/08/2012 08:48 PM, Paul Hoffman wrote:
> On Feb 8, 2012, at 10:56 AM, Andrew Sullivan wrote:
> 
>> No hat.
>> 
>> On Wed, Feb 08, 2012 at 09:30:46AM +0100, W.C.A. Wijngaards
>> wrote:
>>> 
>>> On 02/07/2012 08:51 PM, Mohan Parthasarathy wrote:
>>> 
>>>> How does it help the application to make this more fine
>>>> grained ?
>>> 
>>> No, the application just wants all bogus data to be removed.
>>> Data that is secure and data that is not DNSSEC signed is what
>>> it wants.
>> 
>> It seems to me that the above is either a matter of policy or a
>> matter of implementation.  That is, some applications will surely
>> only want data that they can know for sure is valid, and in
>> particular will not want any unsigned data no matter what.
>> 
>> This could be implemented in more than one way.  One is to hand
>> the application everything that is validated and unsigned, and
>> let the application work out which it wants.  But another would
>> be for the application to be able to signal this choice to the
>> resolver.  No?
> 
> 
> In specific, the current proposal for DANE wants to know if it is
> getting bogus data. It treats bogus data as quite different than
> "no record received". See the bulleted list in section 5 of
> draft-ietf-dane-protocol-16.txt.
> 
> If the DNSEXT WG thinks that it is going to change dnssec-bis to
> make the change Wouter suggests, the DANE WG needs to hear about it
> *very soon*.

Let me state that I do not want to make such a change.  For backwards
compatibility DNSSEC has this facility to figure out which zones are
signed and validatable by the validator, and this backwards
compatibility can be used for DANE too.  Thus it wants to know the
precise secure, insecure and bogus validation results.

Best regards,
   Wouter
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQIcBAEBAgAGBQJPM5EcAAoJEJ9vHC1+BF+NZZ8P/A1qquwHtxibDeRAAoDOZm6m
pO8/n1wiO7JeTf8RlU5aWrLOCv0oejwOtzp68kV2Xgb+G+yJtgWrhMWizxhnDWxR
NY+FJeHrNGGs8GATPjT6j9t079k+VlCdp5lxrdLV7k05tpkbCHOAWmnrBvSqC7AC
Uicf78Iwt3aailho4UawrCiWkWCZTZliXbWQtVqlXis51i4I4g1WScc+Dbwz2xHZ
GWvWBZpZce5XuyprBeZKlzuQCGcBHMc+mcJ5crdaFF5M/m0QIRThpzGEyPDhPPUR
3YXBXBM4cxUZUxbg3mOlbzdcIgQR3vNOSMbP470cVdc10e3304kmKP9IvHCWqnEY
TauAteTRusowRFOFDIVzguocC+tfz/7V2Q0+VWay2qT2BhnnS75LXUYZ4JjHIxJh
3dzQjyMBDqZldChXcDJq08KZNMsJjdrgnDOSZfzZB2ii4n/DJ09jha2AkN4QS5tD
0G4VCDt/IGOYva4XLdi+qHZ843Skj3sP5BZyJ52TQ1yKjIfJ0pfVa7xPtdoXXRzD
5ctkJqNkIHKjkeGie7OACtwWRBgggRJgEnQXj569GZxWSUevTZ2Pv5BRmCI8aodL
y1yx6cvPFiXJSfHg+rEWgHWMZqI9QgoJIkVU+AX3n5ph3dvfL5lDuMvC8KRQHpL2
7Zd//f4hL3W3Ay6JpT0G
=70uC
-----END PGP SIGNATURE-----
_______________________________________________
dnsext mailing list
dnsext@ietf.org
https://www.ietf.org/mailman/listinfo/dnsext