Re: [dnsext] Clarifying the mandatory algorithm rules

["George Barwood" <[e-mail]>]

----- Original Message ----- 
From: "Mark Andrews" <[e-mail]>
To: <[e-mail]>
Sent: Friday, November 19, 2010 12:41 AM
Subject: Re: [dnsext] Clarifying the mandatory algorithm rules


> I think the paragraph in question should be relaxed to make to MUST
> only apply to algorithms listed in the DS / published trust anchors.
> This will allow for gradual introduction of RRSIG for new algorithms.
> The current wording prevents this and is a real pain for large
> zones.

+1

This is how a reasonable person would expect it to work without
consulting the standard, and is the most logical approach.

It reproduces what happens when a zone is first signed, that is
until the DS / trust anchor is published, no verification occurs.

It simplifies removal of an algorithm, by removing the need
to (temporarily) continue to sign RRsets with keys that have
just been removed from the DNSKEY RRset.

The problem I guess is that this is a change to the standard,
and the benefits are not entirely decisive. However if it is
not done I expect zone operators to repeatedly make the same
mistake when changing algorithms.

- George