Re: [dnsext] Issues in WGLC of dnssec-bis-updates

Andrew Sullivan <ajs@anvilwalrusden.com> Tue, 07 February 2012 16:23 UTC

Date: Tue, 07 Feb 2012 11:23:44 -0500
From: Andrew Sullivan <ajs@anvilwalrusden.com>
To: dnsext@ietf.org
Message-ID: <20120207162344.GH9478@mail.yitter.info>
References: <20120207151820.GE9478@crankycanuck.ca> <4F31449C.9040604@nlnetlabs.nl>
MIME-Version: 1.0
Content-Disposition: inline
In-Reply-To: <4F31449C.9040604@nlnetlabs.nl>
User-Agent: Mutt/1.5.21 (2010-09-15)
Subject: Re: [dnsext] Issues in WGLC of dnssec-bis-updates
Precedence: list
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: dnsext-bounces@ietf.org
Errors-To: dnsext-bounces@ietf.org

Hi,

On Tue, Feb 07, 2012 at 04:34:52PM +0100, W.C.A. Wijngaards wrote:
> 
> I feel the first (4033) is a better description.  I personally use a
> definition for this as: this portion of the tree does not have a trust
> anchor above it (higher up the hierarchy), and therefore is not secure,
> insecure, or bogus.  Note that with the root trust anchor the
> indeterminate state no longer occurs, since we know everything is
> covered by that trust anchor.

This is extremely interesting and helpful; thanks.  I wonder about
something, though.  What should we call the state you get when you
have a validating resolver that can only speak to upstream resolvers
that all respond NOTIMP (or similar) to the DO bit?  That case appears
to be covered by the 4035 definition and not the 4033 one.  Is this
"unvalidatable" rather than "indeterminate"?

Best regards,

A
-- 
Andrew Sullivan
ajs@anvilwalrusden.com
_______________________________________________
dnsext mailing list
dnsext@ietf.org
https://www.ietf.org/mailman/listinfo/dnsext

Re: [dnsext] Issues in WGLC of dnssec-bis-updates W.C.A. Wijngaards
[dnsext] Issues in WGLC of dnssec-bis-updates Andrew Sullivan
Re: [dnsext] Issues in WGLC of dnssec-bis-updates W.C.A. Wijngaards
Re: [dnsext] Issues in WGLC of dnssec-bis-updates Andrew Sullivan
Re: [dnsext] Issues in WGLC of dnssec-bis-updates W.C.A. Wijngaards
Re: [dnsext] Issues in WGLC of dnssec-bis-updates Edward Lewis
[dnsext] What is indeterminate Paul Hoffman
Re: [dnsext] Issues in WGLC of dnssec-bis-updates Mohan Parthasarathy
Re: [dnsext] Issues in WGLC of dnssec-bis-updates Mark Andrews
Re: [dnsext] What is indeterminate Mark Andrews
Re: [dnsext] What is indeterminate Paul Hoffman
Re: [dnsext] Issues in WGLC of dnssec-bis-updates W.C.A. Wijngaards
Re: [dnsext] Issues in WGLC of dnssec-bis-updates Mark Andrews
Re: [dnsext] Issues in WGLC of dnssec-bis-updates bmanning
Re: [dnsext] Issues in WGLC of dnssec-bis-updates Eric Brunner-Williams
Re: [dnsext] Issues in WGLC of dnssec-bis-updates Mohan Parthasarathy
Re: [dnsext] Issues in WGLC of dnssec-bis-updates Andrew Sullivan
Re: [dnsext] Issues in WGLC of dnssec-bis-updates Paul Hoffman
Re: [dnsext] Issues in WGLC of dnssec-bis-updates Mark Andrews
Re: [dnsext] Issues in WGLC of dnssec-bis-updates Mohan Parthasarathy
Re: [dnsext] Issues in WGLC of dnssec-bis-updates Edward Lewis
Re: [dnsext] Issues in WGLC of dnssec-bis-updates Mark Andrews
Re: [dnsext] Issues in WGLC of dnssec-bis-updates Mohan Parthasarathy
Re: [dnsext] Issues in WGLC of dnssec-bis-updates W.C.A. Wijngaards
Re: [dnsext] Issues in WGLC of dnssec-bis-updates Andrew Sullivan
Re: [dnsext] Issues in WGLC of dnssec-bis-updates Samuel Weiler
Re: [dnsext] Issues in WGLC of dnssec-bis-updates Paul Hoffman
Re: [dnsext] Issues in WGLC of dnssec-bis-updates Andrew Sullivan
Re: [dnsext] Issues in WGLC of dnssec-bis-updates Paul Hoffman
Re: [dnsext] Issues in WGLC of dnssec-bis-updates Wes Hardaker