Re: [dnsext] MAR proposal #2: Allowing pre-publishing of DNSKEYs

[Edward Lewis <[e-mail]>]

At 10:28 -0400 4/1/11, Samuel Weiler wrote:

>Zones will be required to be signed with each algorithm (though not
>necessarily eack key) present in the zone's DS RRset or configured
>trust anchors.

Looking at my previous message, this probably makes sense.

Just like NS sets - if the cut point NS set is a subset of the 
corresponding apex NS set things work out, if the algorithms in the 
DS set are a subset of the algorithms in the corresponding DNSKEY 
set, things work out.  And the flexibility to allow a change to be 
made on one side happen non-atomically with a change on the other 
side can proceed.

This works for adding and subtracting.

If I add an NS to the child and then the parent, no lame servers.  If 
I subtract the NS from the parent and then from the child, no lame 
servers.  I make the change in a different order between adds and 
deletes, but the same result, the upper is a subset of the lower.
-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis
NeuStar                    You can leave a voice message at [phone]

Me to infant son: "Waah! Waah! Is that all you can say?  Waah?"
Son: "Waah!"