Subject: ad-is-secure

From: Erik Nordmark <[email-masked]>
Date: Thu, 3 Jul 2003 16:46:43 +0200 (CEST)

Time to try to get this document unstuck from an unresponsive AD (myself)...

I'll put this document on the IESG agenda for next week.
AFAICT the changes from 05 to 06 should address the concerns, but there are
IESG members that were not around when this was first discussed by the IESG
more than a year ago so there might be some additional concerns.

Folks (Roy Arends, Steve Bellovin, and Rob Austein) have suggested some
additional clarifications on 06 (and I thank them for there additional review)
included below. Does anybody think that these clarifications are incorrect
please speak now.

Best possible case we can get this approved with an rfc-editor note by next
week.

   Erik

---
Before the last paragraph in section 4 add this paragraph:

	In the latter two cases, the end consumer must also trust the
	path to the trusted resolvers.

Add this paragraph to the end of section 2.2:

	Note that having the AD bit clear on an authoritative answer is
	normal and expected behavior.

The draft also has an odd "MUST" in section 2.2.1:
  Organisations that require that all DNS responses contain
  cryptographically verified data MUST separate the functions of
  authoritative and recursive servers, as authoritative servers are not
  required to validate local secure data.
This introduces a new concept "local secure data", w/o defining it.

Replace that paragraph with:
  Organisations which require that all DNS responses contain
  cryptographically verified data will need to separate the
  authoritative name server and signature verification functions, since
  name servers are not required to validate signatures of data for which
  they are authoritative.

---

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>