Re: [Trans] DNSSEC also needs CT

[Nico Williams <[e-mail]>]

On May 22, 2014 1:12 PM, "Stephen Kent" <[e-mail]> wrote:
>
> PHB,
>
>> On Thu, May 22, 2014 at 1:21 PM, Stephen Kent<[e-mail]>  wrote:
>> Don't think of CT in this case being something to solve a problem
>> faced by DNSSEC users, instead think of it as something that enables
>> use for problems where it is otherwise unsuited.
>
> That's a very confusing last phrase.

I had no problem reading it.  Your complaints that we're all inarticulate
are getting old.

>> The other major advantage is that it provides a tool to avoid some of
>> the cryptographic lock in problems that are causing certain countries
>> to cause issues in ICANN. You don't have to agree with their analysis
>> to find value in addressing the concerns.
>
> I understand their concerns. But the lack of a well-articulated
architecture
> for CT, much less a CT for DNSSEC, makes it hard for me to gauge whether
> this is a good idea.

In other words, your concern is about CT in general, not DNSSEC in
particular.  Sounds like a separable issue to me.  But if CT makes sense
then it makes sense for DNSSEC.

Nico
--