Re: [dnsext] [dane] Aiming towards some specific wording

Answering only to DNSEXT...

At 8:13 +1100 11/22/11, Mark Andrews wrote:
>"insecure" and "indeterminate" zones are logically the same.  Dane
>should just treat them as !secure.

No, they are not the same.

Insecure means I get records indicating there's no possible trust 
chain that can be constructed from the data to anything I have.

Indeterminate means when I try to get records for part of the chain I 
"time-out".  ("No servers could be reached.")

There's a significant semantic difference between the two.  Apart 
from the fact that you won't succeed in constructing a chain, 
"insecure" means it is definitively impossible and "indeterminate" 
means "not with the data at hand, at this time."  The former would be 
data that is not protected, the latter could be declared a service 
failure.

Here's the definition in RFC 4035 I'm pointing to:

4.3.  Determining Security Status of Data
...
    Insecure: An RRset for which the resolver knows that it has no chain
       of signed DNSKEY and DS RRs from any trusted starting point to the
       RRset.  This can occur when the target RRset lies in an unsigned
       zone or in a descendent of an unsigned zone.  In this case, the
       RRset may or may not be signed, but the resolver will not be able
       to verify the signature.
...
    Indeterminate: An RRset for which the resolver is not able to
       determine whether the RRset should be signed, as the resolver is
       not able to obtain the necessary DNSSEC RRs.  This can occur when
       the security-aware resolver is not able to contact security-aware
       name servers for the relevant zones.

-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis             
NeuStar                    You can leave a voice message at +1-571-434-5468

Vote for the word of the day:
"Papa"razzi - father that constantly takes photos of the baby
Corpureaucracy - The institution of corporate "red tape"