On 8/5/2014 6:27 PM, Viktor Dukhovni wrote:
It is when authentication is then used *only* with peers that
publish TLSA RRs and not with peers that don't.
My point was/is that reliance on DNSSec means that there is an
INDEPENDENT authentication hierarchy.
Taking a look at the entire 'system' that DANE is part of, the
authentication is NOT only between peers.
Use DANE without DNSSec, and calling it opportunistic probably makes
sense. Using it with DNSSec and it doesn't.
d/
--
Dave Crocker
Brandenburg InternetWorking
bbiw.net