Draft: draft-ietf-dnsop-terminology-bis-05

Commentary: Fixes issues 5 , 7 , 8 , 9 , 10 , and 11 .
Composition of names -- A name in the global DNS has one or more
labels.  The length of each label is between 0 and 63 octets
inclusive.  In a fully-qualified domain name, the first label is 0
octets long; it is the only label whose length may be 0 octets,
and it is called the "root" or "root label".  A domain name in the
global DNS has a maximum total length of 255 octets; the root
represents one octet for this calculation.
Composition of names -- A name in the global DNS has one or more
labels.  The length of each label is between 0 and 63 octets
inclusive.  In a fully-qualified domain name, the first label is 0
octets long; it is the only label whose length may be 0 octets,
and it is called the "root" or "root label".  A domain name in the
global DNS has a maximum total length of 255 octets in the wire
format; the root represents one octet for this calculation.
Context for resolving a name -- The global DNS root zone
distributed by PTI.
A locally served DNS zone is a special case of private DNS.  Names
are resolved using the DNS protocol in a local context.  RFC6303
defines subdomains of IN-ADDR.ARPA tha are locally served zones.
Resolution of names through locally served zones may result in
ambiguous results.  For example, the same name may resolve to
different results in different locally served DNS zone contexts.
The context through which a locally served zone may be explicit,
for example, as defined in RFC6303, or implicit, as defined by
local DNS administration and not known to the resolution client.
A resolver that acts in recursive mode.  In general, a recursive
resolver is expected to cache the answers it receives (which would
make it a full-service resolver), but some recursive resolvers
might not cache.
The first two definitions above consider the only validity of
individual DNSSEC components such as the RRSIG validity or NSEC
proof validity.  The third definition considers the components of
the entire DNSSEC authentication chain, and thus requires
"configured knowledge of at least one authenticated DNSKEY or DS
RR" (as described in RFC4035, Section 5).
The first two definitions above consider only the validity of
individual DNSSEC components such as the RRSIG validity or NSEC
proof validity.  The third definition considers the components of
the entire DNSSEC authentication chain, and thus requires
"configured knowledge of at least one authenticated DNSKEY or DS
RR" (as described in RFC4035, Section 5).
The terms "authentication" and "verification" are used
interchangeably with "validation" in the sense of the third
definition above.  RFC4033, Section 2, describes the chain linking
trust anchor to DNS data as the "authentication chain".  A
response is considered to be authentic if "all RRsets in the
Answer and Authority sections of the response [are considered] to
be authentic" (RFC4035).  DNS data or responses deemed to be
authentic or validated have a security status of "secure"
(RFC4035, Section 4.3; RFC4033, Section 5).  "Authenticating both
DNS keys and data is a matter of local policy, which may extend or
even override the [DNSSEC] protocol extensions" (RFC4033,
Section 3.1).
The term "authentication" is used interchangeably with
"validation", in the sense of the third definition above.
RFC4033, Section 2, describes the chain linking trust anchor to
DNS data as the "authentication chain".  A response is considered
to be authentic if "all RRsets in the Answer and Authority
sections of the response [are considered] to be authentic"
(RFC4035).  DNS data or responses deemed to be authentic or
validated have a security status of "secure" (RFC4035,
Section 4.3; RFC4033, Section 5).  "Authenticating both DNS keys
and data is a matter of local policy, which may extend or even
override the [DNSSEC] protocol extensions" (RFC4033, Section 3.1).
The term "verification", when used, is usually synonym for
"validation".