Re: [dnsext] [dane] Aiming towards some specific wording

In message <a06240803caf071b97c5c@[10.31.200.137]>7]>, Edward Lewis writes:
> At 8:13 +1100 11/22/11, Mark Andrews wrote:
> >"insecure" and "indeterminate" zones are logically the same.  Dane
> >should just treat them as !secure.
> 
> No, they are not the same.
> 
> Insecure means I get records indicating there's no possible trust 
> chain that can be constructed from the data to anything I have.
> 
> Indeterminate means when I try to get records for part of the chain I 
> "time-out".  ("No servers could be reached.")
> 
> There's a significant semantic difference between the two.  Apart 
> from the fact that you won't succeed in constructing a chain, 
> "insecure" means it is definitively impossible and "indeterminate" 
> means "not with the data at hand, at this time."  The former would be 
> data that is not protected, the latter could be declared a service 
> failure.
> 
> Here's the definition in RFC 4035 I'm pointing to:
> 
> 4.3.  Determining Security Status of Data
> ...
>     Insecure: An RRset for which the resolver knows that it has no chain
>        of signed DNSKEY and DS RRs from any trusted starting point to the
>        RRset.  This can occur when the target RRset lies in an unsigned
>        zone or in a descendent of an unsigned zone.  In this case, the
>        RRset may or may not be signed, but the resolver will not be able
>        to verify the signature.
> ...
>     Indeterminate: An RRset for which the resolver is not able to
>        determine whether the RRset should be signed, as the resolver is
>        not able to obtain the necessary DNSSEC RRs.  This can occur when
>        the security-aware resolver is not able to contact security-aware
>        name servers for the relevant zones.

And the difference between that and bogus is?   It got data and no
signature so it is bogus.  If got data and bad signatures it is
bogus.  It didn't get a response then it has no data.

There are are only 3 states the data can be in.  Secure, insecure and bogus.

-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: marka@isc.org
_______________________________________________
dnsext mailing list
dnsext@ietf.org
https://www.ietf.org/mailman/listinfo/dnsext