Subject: Re: [dnsext] dnssec-bis-updates and the CD bit (fwd)

From: [email-masked]
Date: Thu, 4 Aug 2011 09:52:45 -0400 (EDT)

[I sent this to namedroppers by mistake, having just hit "reply all" and 
not checked the headers closely enough.  Some of you will see it as a 
duplicate.]

On Mon, 1 Nov 2010, Florian Weimer wrote:

> Anyway, I have no problems with the text as-is (in -11, don't know if
> that's current).  Note however that the more or less explicit
> recommendation to set CD by default has security implications: you no
> longer profit from more stringent validation at an upstream validator.
> This should be mentioned in the Security Considerations.

I missed this when preparing -13.  I'm submitting a new version now that 
incorporates this suggestion.

> I think this is a very minor issue because even with the CD fixes, the
> protocol more or less requires that your forwarder has a superset of
> your own trust anchors.  Therefore, the situation that the forwarders
> perform more stringent checks is not a relevant scenario.

I don't understond why a forwarder must have "a superset of your own trust 
anchors", but I don't think that understanding is key to the point in the first 
paragraph I quoted above.

-- Sam