Re: [dnsext] Issues in WGLC of dnssec-bis-updates

At 16:34 +0100 2/7/12, W.C.A. Wijngaards wrote:

>insecure, or bogus.  Note that with the root trust anchor the
>indeterminate state no longer occurs, since we know everything is
>covered by that trust anchor.

I disagree with that.

The Internet that we usually think about as being the only one is 
what I call the "global public Internet".  For the global public 
Internet, the DNS in common use does have a trust anchor for it's 
root zone so the assertion holds for the majority of cases, but then 
again only for recursive servers that have the trust anchor.

There are other inter-networks that use the DNS protocol.  In at 
least one of these, DNSSEC has not been deployed.

And, you can stretch this to the case of a recursive server, on the 
global public Internet, that does not have the root anchor configured 
- and may have another anchor.  To such a server, validating some DNS 
data is impossible (incalculable).

The protocol cannot be defined assuming one particular mode of operation.
-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis
NeuStar                    You can leave a voice message at +1-571-434-5468

2012...time to reuse those 1984 calendars!
_______________________________________________
dnsext mailing list
dnsext@ietf.org
https://www.ietf.org/mailman/listinfo/dnsext