Re: [secdir] secdir review of draft-ietf-homenet-arch-10

[Samuel Weiler <[e-mail]>]

On Wed, 11 Sep 2013, Ray Bellis wrote:

>> -- "The name space(s) should be served authoritatively by the
>>  homenet..."   Why is that necessary?  (Indeed, there is text in
>>  3.7.4 that seems to conflict with this.)
...
> Can you please indicate which text you believe is in conflict?

Sure.

in 3.7.3:

"The name space(s) should be served authoritatively by the
    homenet, most likely by a server resident on the CER."

in 3.7.4

"One approach ... is to run an authoritative
    name service on the CER and a secondary resolving name service
    provided by the ISP or perhaps a cloud-based third party."

The former I see as more prescriptive (you should do X) and the latter 
as just a suggestion (one idea is X).

I was challenging the prescription.  The quotes are necessarily in 
conflict, but they seem to carry very different force.

>> -- There is a recommendation to support DNSSEC on the authoritative
>>  server side (in 3.7.4).  Shouldn't there be a similar
>>  recommendation on the resolver side?
>
> That (short) paragraph is not specific to authoritative servers, it 
> applies to the entire section.  The example of cache-poisoning 
> further indicates its applicability to recursive resolution.

That is not clear from the text.  I read "it is desirable
    to support appropriate name service security methods, including
    DNSSEC." and interpreted as shown above.

-- Sam