Re: issues with draft-ietf-dnsext-dnssec-trans-00.txt

[Paul Vixie <paul@vix.com>]

> > if you do nothing, then paranoid clients will continue to have very
> > little confidence in spoofed data.  if you use a zone-covering NSEC
> > for all responses, then paranoid clients will have high confidence
> > in spoofed data.
> 
> Which is one reason why it would be good if there was some signaling
> that denials should not be treated as authenticated: ...

if you want non-authenticated denial, maybe you should just leave out
the NSEC altogether.  putting your signature on one that covers names
which actually exist, and then leaking that signed "lie" to the universe,
where others could replay or misinterpret it out of context, seems like
a huge mistake to me.

--
to unsubscribe send a message to namedroppers-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>