Re: [dnsext] Clarifying the mandatory algorithm rules

[Mark Andrews <[e-mail]>]

In message <[e-mail]>, Samuel Wei
ler writes:
> Thank you very much!
> 
> > I think the general consensus is that a validator should at least be
> > able to check the algorithms in the DS RRset (Please correct me if I am
> > being to hasty in my conclusion). There is still debate whether the
> > validator SHOULD or MAY do this (Ed Lewis argued the term 'could', I
> > think that translates to the RFC2119 term MAY).
> ...
> > Proposed text would then be:
> >
> >  "The validator SHOULD or MAY check (choice here) that the algorithms
> >   signaled in the DS-set work (but only for algorithms supported by
> >   the validator, of course)."
> 
> I understand the desire for MAY check all algorithms, and I'm fine 
> with that.  (I tend to agree with Ed on SHOULD NOT, but 
> whatever.)
> 
> I do not yet understand the reason for looking only at the DS RRset 
> and not also the DNSKEY RRset, and I'd very much like to.

The rule was put in there to ensure that a signer generated a zone
which had the information required for the validator to validate
the records in the zone.

> If we tell validators to that the DNSKEY RRset isn't being used for 
> signalling, then presumably we're also changing what it means to be a 
> "properly signed zone".  What's the new definition?  And why that 
> change?
> 
> -- Sam
> _______________________________________________
> dnsext mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/dnsext
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: [phone]                 INTERNET: [e-mail]