Re: [secdir] SECDIR review of draft-ietf-dnsop-root-loopback-03

[joel jaeggli <[e-mail]>]

On 9/14/15 8:17 AM, Paul Hoffman wrote:
> Thanks! We have made these changes in the pre-draft of -04. If the ADs
> want us to publish this before the IESG review, we can; otherwise, we'll
> wait until after the IESG review to release them.


It's fine by me if you do that. no reason not to be dicsussing the
latest version so long as we have a few days between the update and the
review call.

thanks
joel

> --Paul Hoffman
> 
>       <t>A system that does not follow the DNSSEC-related requirements
> given
>       in <xref target="reqs"/> can be fooled into giving bad responses
> in the
>       same way as any recursive resolver that does not do DNSSEC
> validation on
>       responses from a remote root server. Anyone deploying the method
>       described in this document should be familiar with the operational
> benefits
>       and costs of deploying DNSSEC <xref target="RFC4033"/>.</t>
> 
>       <t>As stated in <xref target="intro"/>, this design explicitly
> only allows
>       the new root zone server to be run on a loopback address, in order to
>       prevent the server from serving authoritative answers to any
> system other
>       than the recursive resolver. This has the security property of
> limiting
>       damage to any other system that might try to rely on the copy of
> the root
>       in case that copy becomes altered.</t>
>