Re: [dnsext] Clarifying the mandatory algorithm rules

[Samuel Weiler <[e-mail]>]

On Thu, 18 Nov 2010, Phillip Hallam-Baker wrote:

> I can't quite understand why we would make a change to require 
> acceptance of the unsigned zone in this case.

There is a difference of opinion about what's being "changed" here. 
I think my proposed clarification is NOT a change -- RFC4035 does not 
tell resolvers to do what Unbound is doing.  Wouter seems to disagree.

>From my perspective, it's Wouter (and you?) that wants to make a 
change, in the form of requiring resolvers to check something RFC4035 
doesn't require them to check.

Different perspectives.


The "check everything and fail if anything break" seems to differ in 
spirit from the guidance that's already in dnssec-bis-updates; see 
section 5.4 "Caution About Local Policy and Multiple RRSIGs". 
(Slightly different details, same flavor.)  That section has been in 
this doc since the -00 version, dated May 2005.

While there may be merit in the approach Wouter suggests, my 
inclination as doc editor is to avoid changes unless strictly 
necessary.

Since we seem to have different ideas about the current state of the 
world, perhaps we need some more voices in this.  Perhaps the BIND 
authors have an opinion.  :-)

-- Sam