Re: [dnsext] Clarifying the mandatory algorithm rules

[Samuel Weiler <[e-mail]>]

Thank you very much!

> I think the general consensus is that a validator should at least be
> able to check the algorithms in the DS RRset (Please correct me if I am
> being to hasty in my conclusion). There is still debate whether the
> validator SHOULD or MAY do this (Ed Lewis argued the term 'could', I
> think that translates to the RFC2119 term MAY).
...
> Proposed text would then be:
>
>  "The validator SHOULD or MAY check (choice here) that the algorithms
>   signaled in the DS-set work (but only for algorithms supported by
>   the validator, of course)."

I understand the desire for MAY check all algorithms, and I'm fine 
with that.  (I tend to agree with Ed on SHOULD NOT, but 
whatever.)

I do not yet understand the reason for looking only at the DS RRset 
and not also the DNSKEY RRset, and I'd very much like to.

If we tell validators to that the DNSKEY RRset isn't being used for 
signalling, then presumably we're also changing what it means to be a 
"properly signed zone".  What's the new definition?  And why that 
change?

-- Sam