Re: [dnsext] Clarifying the mandatory algorithm rules

[Samuel Weiler <[e-mail]>]

On Tue, 30 Nov 2010, W.C.A. Wijngaards wrote:

> It is clear that checking the set of algorithms present in the DNSKEY
> set is not a good idea, and checking the set of algorithms from the DS
> set is the right, more lenient way to go.

I apologize for checking out of this discussion last fall.

I would like the WG's help understanding where you want to go with 
this topic.  I don't fully understand the argument in favor of not 
checking the algorithms on the child side of the zone cut (= the ones 
in the DNSKEY RRset), nor am I sure that was the direction everyone 
seemed to want to go.  Could someone summarize the current state of 
this?

My own inclination is (still) to treat this as a clarification, saying 
that validators are not required to enforce these rules.  (In other 
words, the extra checks Unbound did were just fine, though 
unnecessary.  BIND's lenient approach was also fine.)  Two specific 
pieces of proposed text can be found in the first message in this 
thread, dated 18 November 2010.

-- Sam