Re: [dnsext] CDS RRTYPE review - Comments period end Mar 29th

[Mark Andrews <[e-mail]>]

In message <[e-mail]>, "Ste
phan Lagerholm" writes:
> George B and Mark A,
> 
> >In either case the software that signs zones has to be updated.
> 
> If adding a new flag to DNSKEY and if the software already supports the
> DNSKEY RR with arbitrary flags, then no update is needed. For example, I
> could use an old version of ISC dig and still make sense out of the
> DNSKEY record even if a new flag was added. But I had to upgrade ISC dig
> if I wanted to figure out details about the CDS record.

Running DS throug a really old version of DiG produces this:

isc.org.		20h56m50s IN TYPE43  \# 36 (	; unknown RR type
	32 5c 05 02 f1 e1 84 c0 e1 d6 15 d2 0e b3 c2 23 ; 2\.............#
	ac ed 3b 03 c7 73 dd 95 2d 5f 0e b5 c7 77 58 6d ; ..;..s..-_...wXm
	e1 8d a6 b5 )					; ....
isc.org.		20h56m50s IN TYPE43  \# 24 (	; unknown RR type
	32 5c 05 01 98 21 13 d0 8b 4c 6a 1d 9f 6a ee 1e ; 2\...!...Lj..j..
	22 37 ae f6 9f 3f 97 59 )			; "7...?.Y

The key id is 0x325c (12892), the algorithm in 5 and the hashs are 2
for the first and 1 for the second.

> >If the output is in text format, the generic text format of RFC3597
> section 5
> >may be used if the serving software for the master server has not been
> updated.
> 
> The RDATA field would still just be a "blob". How would I for example be
> able to verify the Key Tag, Algorithm or Digest Type field unless the
> software you are using is programmed to understand that the format the
> same as for the DS record?

Given the blob is printed in hex you could just read two of those fields
directly and the third nearly as easily.

	Digest type: 01 or 02 (currently in use)
	Algorithm: 01 ... 0a  (currently in use)
	Keytag: is a little harder but not much.

Or you could take the TYPEXXX .... and turn in into TYPE43 ... and
put that through any piece of software that understands DS and
unknown types.

> >The software for secondary servers does not need to be updated in any
> case,
> >assuming it implements RFC3597 ( that is it can handle unknown types ),
> >which is of course the case for all mainstream implementations.
> 
> Agreed, I'm taking about software that interacts with humans and try to
> display something meaningful for them (provisioning system, IPAM,
> debugging tools, etc)
> 
> (For the record, I'm positive to this draft other than using a new RR
> type. I would rather like to see an "embryonic" flag to the DNSKEY
> similar to what the revoked flag is doing for old keys is RFC5011)
> 
> /S
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: [phone]                 INTERNET: [e-mail]