Re: [dns-privacy] [Fwd: New Version Notification for draft-vandijk-dprive-ds-dot-signal-and-pin-00.txt]

[Paul Wouters <[e-mail]>]

Note for DNSKEY algorithm, we could use 253 or 254:

https://tools.ietf.org/html/rfc4034#appendix-A.1.1

A.1.1.  Private Algorithm Types

    Algorithm number 253 is reserved for private use and will never be
    assigned to a specific algorithm.  The public key area in the DNSKEY
    RR and the signature area in the RRSIG RR begin with a wire encoded
    domain name, which MUST NOT be compressed.  The domain name indicates
    the private algorithm to use, and the remainder of the public key
    area is determined by that algorithm.  Entities should only use
    domain names they control to designate their private algorithms.

    Algorithm number 254 is reserved for private use and will never be
    assigned to a specific algorithm.  The public key area in the DNSKEY
    RR and the signature area in the RRSIG RR begin with an unsigned
    length byte followed by a BER encoded Object Identifier (ISO OID) of
    that length.  The OID indicates the private algorithm in use, and the
    remainder of the area is whatever is required by that algorithm.
    Entities should only use OIDs they control to designate their private
    algorithms.


DNS software might already support ignoring these algorithms without
adding too much noise to the DNSSEC validation process of having
"wrong" DNSKEY's.

Paul