Re: [dnsext] Clarifying the mandatory algorithm rules

[Mark Andrews <[e-mail]>]

In message <[e-mail]>, Samuel Weil
er writes:
> On Tue, 30 Nov 2010, W.C.A. Wijngaards wrote:
> 
> > It is clear that checking the set of algorithms present in the DNSKEY
> > set is not a good idea, and checking the set of algorithms from the DS
> > set is the right, more lenient way to go.
> 
> I apologize for checking out of this discussion last fall.
> 
> I would like the WG's help understanding where you want to go with 
> this topic.  I don't fully understand the argument in favor of not 
> checking the algorithms on the child side of the zone cut (= the ones 
> in the DNSKEY RRset), nor am I sure that was the direction everyone 
> seemed to want to go.  Could someone summarize the current state of 
> this?
> 
> My own inclination is (still) to treat this as a clarification, saying 
> that validators are not required to enforce these rules.  (In other 
> words, the extra checks Unbound did were just fine, though 
> unnecessary.  BIND's lenient approach was also fine.)  Two specific 
> pieces of proposed text can be found in the first message in this 
> thread, dated 18 November 2010.

While we think about this ISC has also had bug reports claiming
that is we don't publish DNSKEY prior to signing with them we are
break RFC 4035 because it allows verification of every RRSIG as a
policy and the only way to do that is to publish the DNSKEY prior
to use.

   If other RRSIG RRs also cover this RRset, the local resolver security
   policy determines whether the resolver also has to test these RRSIG
   RRs and how to resolve conflicts if these RRSIG RRs lead to differing
   results.

> -- Sam
> _______________________________________________
> dnsext mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/dnsext
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: [phone]                 INTERNET: [e-mail]