Subject: Re: IESG feedback on dnsext-ad-is-secure

From: Paul Vixie <[email-masked]>
Date: Fri, 14 Jun 2002 10:14:23 -0700

> >   | I've been assuming that 'some of the required signatures are invalid'
> >   | would mean that the data wouldn't be returned to the client.
> 
> > Maybe it does, but I would certainly hope that's not the expected
> > interpretation (by default).
> 
> It has to be, or the major benefit of DNSSEC is lost.  [...]

So, six++ years into the experiment, we still don't agree on what problem
DNSSEC is supposed to solve, and what the underlying security model will be?

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Randy Bush <[email-masked]>
Date: Fri, 14 Jun 2002 10:55:00 -0700

> DNSSEC is supposed to solve, and what the underlying security model will

you may find draft-ietf-dnsext-dns-threats-01.txt useful in this regard

randy