Re: [dnsext] Issues in WGLC of dnssec-bis-updates

On Tue, Feb 07, 2012 at 04:34:52PM +0100, W.C.A. Wijngaards wrote:
> -----BEGIN PGP SIGNED MESSAGE-----Hash: SHA1
> Hi Andrew,
> I support the default actions you describe.  Below are reasons forthings I feel more strongly about.
> > ISSUE 1: Indeterminacy of Indeterminate
> I feel the first (4033) is a better description.  I personally use adefinition for this as: this portion of the tree does not have a trustanchor above it (higher up the hierarchy), and therefore is not secure,insecure, or bogus.  Note that with the root trust anchor theindeterminate state no longer occurs, since we know everything iscovered by that trust anchor.

	Which root?  The ICANN root?  My corporate root?
	Folks use IP and DNS in networks that may not be connected to the 
	"public" Internet and thus to the ICANN root key.
	So I would say that there is existence proof that you can find 
	the ICANN root trust anchor in an indeterminate state.  I would 
	hope your code is agile enough to cope.


> > ISSUE 2: Ignoring CNAME signatures
> The change requested seems impossible (not compatible with deployedcode, and not future compatible with intended feature too) to me, thus Isupport no change.
> Best regards,   Wouter

/bill
_______________________________________________
dnsext mailing list
dnsext@ietf.org
https://www.ietf.org/mailman/listinfo/dnsext