Subject: DNSEXT WGLC: DNS Threats

From: Ólafur Gudmundsson/DNSEXT co-chair <[email-masked]>
Date: Wed, 12 Mar 2003 23:00:26 -0500

This starts a 2 week Working Group last call on this document,
concluding on March 28'th 2003.

Although the DNS Security Extensions (DNSSEC) have been under
development for most of the last decade, the IETF has never written
down the specific set of threats against which DNSSEC is designed to
protect.  Among other drawbacks, this cart-before-the-horse situation
has made it difficult to determine whether DNSSEC meets its design
goals, since its design goals are not well specified.  This note
attempts to document some of the known threats to the DNS, and, in
doing so, attempts to measure to what extent (if any) DNSSEC is a
useful tool in defending against these threats.

http://www.ietf.org/internet-drafts/draft-ietf-dnsext-dns-threats-02.txt

This document is to be published as Informational. Note DNSSECbis
documents refer to this document.

Silence on this document will be taken as instruction to chairs
to drop the document.

	Olafur

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: "Loomis, Rip" <[email-masked]>
Date: Thu, 13 Mar 2003 09:21:59 -0500

Derek/Rob--

Really an excellent document overall.  I support this document
but I have a few minor editorial nits.  Perhaps I'm being anal-
retentive, so do with these what ye will.

Last paragraph in section 1 should read "...and refers to TKEY and..."
for proper subject/verb agreement (earlier in that sentence, you
say "this note uses".)

Near the bottom of section 2.1 I think you only need one "all" in
  - Perform all all of the DNSSEC signature checking on its own

Other than those _incredibly_ minor points, the document looks
great and is now required reading for the folks here working on
DNS Security.

For the WG Chairs:
I support the publication of this document as an Informational RFC.

--
Rip Loomis                         Senior Systems Security Engineer
SAIC Enterprise Security Solutions Group     www.saic.com/securebiz
Center for Information Security Technology   www.cist-east.saic.com