Subject: [dnsext] "knowing A root key" was Re: draft-diao-aip-dns

From: Edward Lewis <[email-masked]>
Date: Thu, 5 Jul 2012 14:57:17 -0400

At 8:32 -0700 6/29/12, Nicholas Weaver wrote:

>... DNSSEC, in practice, relies on knowing A root key.

Not really.  The set of trust anchors a validator use is a local 
policy consideration.

RFC 4035

4.4.  Configured Trust Anchors

    A security-aware resolver MUST be capable of being configured with at
    least one trusted public key or DS RR and SHOULD be capable of being
    configured with multiple trusted public keys or DS RRs...

-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis             
NeuStar                    You can leave a voice message at +1-571-434-5468

2012...time to reuse those 1984 calendars!