Re: comments on ds-13

Ólafur Guðmundsson <ogud@ogud.com> Tue, 11 March 2003 20:21 UTC

Date: Tue, 11 Mar 2003 15:04:38 -0500
From: Ólafur Guðmundsson <ogud@ogud.com>
Subject: Re: comments on ds-13
In-reply-to: <20030311175746.C0D55379E40@as.vix.com>
To: Paul Vixie <paul@vix.com>, namedroppers@ops.ietf.org
Message-id: <5.1.1.6.2.20030311144427.032c2cc0@localhost>
MIME-version: 1.0
Content-type: text/plain; format="flowed"; charset="us-ascii"
Sender: owner-namedroppers@ops.ietf.org
Precedence: bulk

At 12:57 2003-03-11, Paul Vixie wrote:
>olafur, you wrote (in draft-ietf-dnsext-delegation-signer-13.txt),
>
> >> DS RRsets MUST NOT appear at non-delegation points or at a zone's apex.
>
>why not?  i think you can say they are irrelevant elsewhere, but i don't
>think there's a way to show that they are in any way harmful elsewhere.

Well the record is called "Delegation Signer".
IMHO this is a record for DNS consumption, and only for DNS, it
makes limited sense to have DS record at non delegation points
within the context of current DNSSEC specification.
In addition there are DS rules specify that it resides on
the upper side of delegation.
Does allowing DS to reside at normal node require more special cases?

If someone figures out other uses for the DS concept that is not
related to standard DNSSEC, lets define a new record for that.
If the new usage is to somehow improve/add on DNSSEC then the
use of DS should be considered.

>as a simple document quality issue, there is no way to enforce this
>requirement and no reliable way to even know when it has been violated.
>so at best it would be a SHOULD not a MUST.

This is a real good argument, and I would be happy to make the change
base on this, if the working group says so.

>however, even as a SHOULD, it overreaches.  the proper attitude of a
>document toward its protocol is to specify things which, if left
>unspecified, will lead to loss of interoperability or functionality.
>there is no such argument to be made for restricting the placement of
>DS RRs (or for restricting the use of KEYs for that matter.)

Remember the name and purpose of the record.
Key on the other hand can be assigned to hosts for dynamic update purposes
thus KEY is not restricted to APEX only.
IFF KEY was restricted to DNSSEC zone signing only then restricting it
to the apex would make sense.

         Olafur

--
to unsubscribe send a message to namedroppers-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

Re: comments on ds-13 Ólafur Guðmundsson