Re: [dnsext] Issues in WGLC of dnssec-bis-updates

In message <4F315725.4010705@nlnetlabs.nl>, "W.C.A. Wijngaards" writes:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Hi Andrew,
> 
> On 02/07/2012 05:23 PM, Andrew Sullivan wrote:
> > On Tue, Feb 07, 2012 at 04:34:52PM +0100, W.C.A. Wijngaards wrote:
> >>
> >> I feel the first (4033) is a better description.  I personally use a
> >> definition for this as: this portion of the tree does not have a trust
> >> anchor above it (higher up the hierarchy), and therefore is not secure,
> >> insecure, or bogus.  Note that with the root trust anchor the
> >> indeterminate state no longer occurs, since we know everything is
> >> covered by that trust anchor.
> > 
> > This is extremely interesting and helpful; thanks.  I wonder about
> > something, though.  What should we call the state you get when you
> > have a validating resolver that can only speak to upstream resolvers
> > that all respond NOTIMP (or similar) to the DO bit?  That case appears
> > to be covered by the 4035 definition and not the 4033 one.  Is this
> > "unvalidatable" rather than "indeterminate"?
> 
> This would make data that is not covered by a trust anchor indeterminate
> (like it was before, you have no anchor that covers it so can check no
> signatures).  Data covered by a trust anchor becomes bogus, because you
> cannot get the DNSSEC data for zone of the trust anchor, and its
> delegations need to tell you if the data covered by it is secure or
> insecure; these signatures are withheld, and this makes the result bogus.

The delegation is secure or insecure.  The data is secure, bogus
or indeterminate.  When you follow a insecure delegation the data
is no longer under the trust anchor, i.e. there is no chain from a
trust anchor to it.

> Best regards,
>    Wouter
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: marka@isc.org
_______________________________________________
dnsext mailing list
dnsext@ietf.org
https://www.ietf.org/mailman/listinfo/dnsext