Subject: RE: zone naming terms (was Opt-in wg last call)

From: "Loomis, Rip" <[email-masked]>
Date: Wed, 10 Apr 2002 13:22:49 -0400

(Hello Scott and Ed--)

Even the term "secure" set is a misnomer IMHO.

"Security" of such things depends on perspective and
numerous other factors.  If someone signs data
and then the zone private key is compromised, then
to me any data signed with that key is no longer
"secure".  It is, however, still signed.  Similarly,
if _you_ statically configure a key as trusted, but
_I_ don't configure that key as trusted, then you
might term the data within a specific zone as
"secure" while I would state that it is "signed but
not secure" (according to the rules I think you're
using).

I would recommend the following terms:

"Signed RR set" (or "signed set")
"Unsigned RR set" (or "unsigned set")
"Fully signed zone" - signed IAW RFC 2535, or
	2535+DS
"Opt-in signed zone" (or "partially signed zone")
	- signed IAW 2535 + Opt-in (w/ or w/o DS)

These terms are still perhaps annoying and confusing--
but at least they're consistent with each other and
don't depend on one's world view.

--
Rip Loomis                         Senior Systems Security Engineer
SAIC Secure Business Solutions Group         www.saic.com/securebiz
Center for Information Security Technology   www.cist-east.saic.com

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>