Re: [dnsext] Clarifying the mandatory algorithm rules

[Samuel Weiler <[e-mail]>]

As in my last message, Matthijs, Mark Andrews, and I spent some time 
today trying to understand each other.  This is the first of three 
posts trying to capture our understandings.

I believe we're in agreement about the mandatory algorithm rules in
rfc4035 and the general direction in which they should be clarified.
There are two proposals for changing these rules, which I'm describing
in separate notes.  I think we should resolve both now so that we only
have to make the clarification once.  Please respond to each of those
notes separately with your opinions on each.

I'll restate the current (clarified) rules here, though the actual
clarification text will probably look more like what I posted in
November.  Think of this more as a starting point for considering the
two proposals that follow than as final text to be added to
dnssec-bis-updates.

    The DS RRset and DNSKEY RRset are used to signal which algorithms
    are used to sign a zone.  The pressence of an algorithm in a zone's
    DS or DNSKEY RRset set signals that that algorithm is used to sign
    the entire zone.

    When signed, a zone MUST include a DNSKEY for each algorithm
    present in the zone's DS RRset and expected trust anchors for the
    zone.  The zone must also be signed with each algorithm (though not
    each key) present in the DNSKEY RRset.  It is possible to add
    algorithms at the DNSKEY that aren't in the DS record, but not
    vice-versa.

    [The above is all clarification -- the below is arguably a change,
    and it's one that would itself be changed by proposal #1.]

    These rules, an indicated by their pressence in second 2 of 4035,
    are rules for zone singers, not rules for validators.  Validators
    SHOULD accept any single valid path.  They SHOULD NOT insist that
    all algorithms signalled in the DS RRset work, and they MUST NOT
    insist that all algorithms signalled in the DNSKEY RRset work.