Re: [dane] Draft for serializing DNSSEC chains (01)

["W.C.A. Wijngaards" <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi Adam,

On 07/01/2011 07:16 PM, Adam Langley wrote:
> Addressing comments:
> 
> 1) The details of the format have been pulled out from the
> verification procedure and the similarities to the DNS wire format
> have been highlighted.
> 2) A high level procedure for constructing the chains has been added.
> 
> http://tools.ietf.org/html/draft-agl-dane-serializechain-01

It says: Filter the possible entry keys to
         only include those that have the SEP bit set in the flags.
But the RFCs say you MUST NOT distinguish based on the SEP bit. It is
for human consumption (and perhaps signer automation).  Skip this step
and remove this line.  Also at other points you check flags, again the
SEP flag is not required.  Only the ZSK flag, which allows a DNSKEY to
sign zone data (required for both KSK and ZSK keys, confusingly), is
something to check.

In case of algorithm rollover by the zones, you need to pick up one key
per algorithm to store.  Because some machines may support only one
algorithm.

A DNAME can simply be treated like you treat the CNAME redirect, but you
store the DNAME+RRSIG.  (the synthesized CNAME can be omitted since you
want to save bytes), then you synthesize the redirect with DNAME rules
(replace suffix labels).

Best regards,
   Wouter
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iQIcBAEBAgAGBQJOEXXxAAoJEJ9vHC1+BF+NDX0P/39SnNZGNpb3Aga+QnzBpdKY
LFeJ9/3cLmjSbls8bazmEU9D37y6N7VcoAjQqjwk22WuzTb4Tedss6d/w5QKJclK
06WUTk05McEHSeQSn8ybY8yXDTQMdP0KruheAPFfDYmmESNaSxr4R4dSspg5WZ4F
CqmXexFMuELx1kgooEmTndlhyKNd7gtpko6JKWmbA5pYII0wkmbRrN/MV+eqohDB
uSMEOZqi5avT+tMUELZIM5OI7RRz7ULxIeIuKOeHRlonz3Q9m/TwMJvnx7bD83Hf
R+zavhpLXGjPoUQyXGe9FvJP+EE4/ZiNGxJEHKpHiUPjyY/V9TEEdAr4yKehN5hF
aLkQ6VRpq4Swv7ZREAGETO++DOfEnYkP2o0GQCq8NXQBkdZVJD2dIMNrory8WifQ
IprebTpRucVIq6Iv2ckpyQIWSmsy+bX0ngTErvgf4UJM7cPYl0m65ODsxG7yOzWk
RWRgrRepuVcUWm1YGIWU0uqG2cJpag6ZYtS4e0z4sX26598uO6FZafsrhdnkIdgp
Li+FOs1JLonfZnZtDkOXebzVLnTjsIKQvzz8IKJvPKAiQWu+MiK1brJUloHRB3Wr
N7bArSPbrVJ2tEmUaZBq+mu/Xi/sF5jS7d8NXbVkycYixMC48O/edlBVecA8fELD
W0kY3VgW2eQnsRurOGQn
=Jagm
-----END PGP SIGNATURE-----