Re: [dnsext] Clarifying the mandatory algorithm rules

[Edward Lewis <[e-mail]>]

At 8:46 -0700 3/17/11, Casey Deccio wrote:

>My apologies for the misinterpretation.  Even with the clear context of
>your opinion, I somehow got lost with your opening paragraph of your example.

Ok, again...(not frustrated that you misinterpreted, frustrated that 
I didn't remove enough pronouns)

The reason for the specification is to set the expectation of the 
validator (the receiving end).  The specification requires the signer 
(the sending end) to generate and publish at least one signature of 
each algorithm listed in the zone's DS record set.  Because of this 
rule the validator can expect that a signature by a specific 
algorithm the validator wants to use for a set of data in the zone 
will be available if listed in the DS record set.  With this 
expectation, if the validator receives a data set from the zone and 
cannot obtain a signature, then the validator is to declare a 
protocol failure.  The validator does not need the other signatures, 
therefore should not waste time evaluating them.  These other 
signatures might be important to other validators.


What I didn't explain this time is why the DS record set is important 
to all of this.
-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis
NeuStar                    You can leave a voice message at [phone]

Me to infant son: "Waah! Waah! Is that all you can say?  Waah?"
Son: "Waah!"