Re: [dnsext] CDS RRTYPE review - Comments period end Mar 29th

[Mark Andrews <[e-mail]>]

In message <[e-mail]>, "Ste
phan Lagerholm" writes:
> Mark,
> 
> >Running DS throug a really old version of DiG produces this:
> >
> >isc.org.		20h56m50s IN TYPE43  \# 36 (	; unknown RR
> type
> >	32 5c 05 02 f1 e1 84 c0 e1 d6 15 d2 0e b3 c2 23 ;
> 2\.............#
> >	ac ed 3b 03 c7 73 dd 95 2d 5f 0e b5 c7 77 58 6d ;
> ..;..s..-_...wXm
> >	e1 8d a6 b5 )					; ....
> >isc.org.		20h56m50s IN TYPE43  \# 24 (	; unknown RR
> type
> >	32 5c 05 01 98 21 13 d0 8b 4c 6a 1d 9f 6a ee 1e ;
> 2\...!...Lj..j..
> >	22 37 ae f6 9f 3f 97 59 )			; "7...?.Y
> >
> >The key id is 0x325c (12892), the algorithm in 5 and the hashs are 2
> >for the first and 1 for the second.
> 
> Our definition of what "display it in a meaningful way" differs. If a
> new flag was used instead, then no changes to dig or any other program
> would be needed:
> 
>                         VVVV                    VVV
> isc.org.                5361    IN      DNSKEY  512 3 5
> BEAAAAO6L6BadeFzvt6J63GD
> GrFANfJAitCd9Njcj49y6PE1Bv6t33sE
> yxSVi4KWbjQgViMCxAArxP0IhDLhYFGbsU2ugkQ4UMFCPgY
> IVxC1yvBw 1Gt7p+SBQU9qX+Il/cqYTJWQkWRdDPHJoaMT1+f7e6YLlntxpl+M7yw3
> aOEbCByPzw=3D=3D

The on going costs of trying to do this with DNSKEY flags completely
overwhelms the one off costs of add a new type.  DNSKEY flags change
key ids.  Revoke is already a mess as it changes the keyid.  Adding
a second changing flag to the mix is just not on.

I can add CDS to BIND in 10 minutes once I have the type code.
It would be weeks of work to add the key flags as you need to do
thinks like compute the signatures with and without the flag in
place or fully work out all the timing issues.

Mark
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: [phone]                 INTERNET: [e-mail]