Re: [dnsext] WGLC: draft-ietf-dnsext-dnssec-bis-updates-16

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi,

I have reviewed, carefully, and support publication.

Some (additional) comments, they have little substance.

The section and appendix on CD bits are long.  Not wrong, but long.
With the root trust anchor deployed, not having a covering trust anchor
is unlikely.  The last validating resolver is the one that can be
trusted, upstream validating resolvers are connected via some network
transport, and trust may therefore not be advisable.

Section 6.2 is correct.  But its tone is loose.  It is about lenient
acceptance of the SEP flag.  Please say that, or say that the proper
setting of the SEP flag is defined in its RFC.

Thanks to Sam, David and Rob for editing.

Best regards, Wouter

On 01/20/2012 05:55 PM, Edward Lewis wrote:
> Comments.
> 
> In 2005 it was too soon to publish, now it is not.  And at this point
> there may be more and more wrinkles in the DNSSEC specs, but we need to
> get out at least this (first) update.
> 
> Some comments:
> 
> Pressence has a presence in the document.  It shouldn't (the spelling, I
> mean).
> 
> 5.9's title is misleading.  The content is good, it's about answering
> from cache in the face of a CD query.  But "always doing CD" only
> applies to elements that will do their own validation.
> 
> 5.4 could optionally make the point that a validator that expects all
> signatures to be good and/or all chains to work is vulnerable to
> malicious insertions of gibberish-based signatures.  It's harder to
> construct a good chain than a false chain.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.15 (GNU/Linux)
Comment: Using GnuPG with SUSE - http://enigmail.mozdev.org/

iQIcBAEBAgAGBQJPH+uMAAoJEJ9vHC1+BF+NnZYQAIsY6q3t5ogVfOwtt3fBy1og
YFwK69nmP8B/SBmJjaXgQIkevBS0lOOqWvnwpGo2moxZfmDvNVHIZqlRv1Yab6NQ
bsWCGP9JfgrGd1l8mqfO08yDOGMcGAZSNsgToa+2cG9zyLfBzowZOx0hAmRXp4bQ
Yclz4zexSUxeCYSIF6I73xWJ2E61Ld+SxLfS2PdazIVF6NPPj1lek5IpqZ+mk3gy
jSRLUQnm70vDEoS7uosCQfkpHyFzwrjEWdaVTHG7IBNiZ1J8fO4qSob0+44lqr4O
LZcnCybQvcb43324321STQaCer+QScvl6UJymbU+YZS9ALO00gVhu2oDYslV+XOC
jA39v5ssTUAA4BPHf3x6D7oPU39nz/j6sFEw5Gvoj2rskaWex0WNDeLA4+i5HzV0
RvevpjnGvE0yrcqxIu9ZVwOKBAqTp8HnRyedC3+4PH9mOuT+RxTADjGySdZOREcf
+mSgGsoHkEIMjl0v1+S5bpdyq8dGNLn2kojjH8vm5e9HFKu4ITH10MPUiyOzvDf1
U4akvAk13k5CWiHPbFJX92uUgQ6C1Kd6l6u62wEFFAayv68aejIHn3CZQpTdmXTp
K5NFlVISL158i1KZ4jtNK+Em4Hk0YJvNsDdMzSUeaJrwtIXSuyMdfSenCfmaHEkl
InejDsWOP+VLUJ5+zIOI
=UJX8
-----END PGP SIGNATURE-----
_______________________________________________
dnsext mailing list
dnsext@ietf.org
https://www.ietf.org/mailman/listinfo/dnsext