Re: [DNSOP] I-D Action: draft-ietf-dnsop-edns-key-tag-00.txt

Stephane Bortzmeyer <bortzmeyer@nic.fr> Fri, 08 January 2016 20:53 UTC

Date: Fri, 08 Jan 2016 21:48:51 +0100
From: Stephane Bortzmeyer <bortzmeyer@nic.fr>
To: dnsop@ietf.org
Message-ID: <20160108204851.GA28421@sources.org>
References: <20151209202733.1080.44157.idtracker@ietfa.amsl.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <20151209202733.1080.44157.idtracker@ietfa.amsl.com>
User-Agent: Mutt/1.5.23 (2014-03-12)
Archived-At: <http://mailarchive.ietf.org/arch/msg/dnsop/_c5PfNQUmqzgIElkiPX-3Sntgf8>
Subject: Re: [DNSOP] I-D Action: draft-ietf-dnsop-edns-key-tag-00.txt
Precedence: list

On Wed, Dec 09, 2015 at 12:27:33PM -0800,
 internet-drafts@ietf.org <internet-drafts@ietf.org> wrote 
 a message of 39 lines which said:

>         Title           : The EDNS Key Tag Option
>         Author          : Duane Wessels
> 	Filename        : draft-ietf-dnsop-edns-key-tag-00.txt

5.2.1 says: "If the client included the DO and Checking Disabled (CD)
bits, but did not include the edns-key-tag option in the query, the
validating recursive resolver MAY include the option with its own Key
Tag values in full."

I do not understand why. If the client sends DO and CD, it means the
server won't validate and therefore "its own Key Tag values" is
irrelevant, it won't be the keys used for validation.

[Generally speaking, I think it complicated the protocol for little or
zero gain. The key tags should be added by the one who validates,
period.]

Re: [DNSOP] I-D Action: draft-ietf-dnsop-edns-key… Stephane Bortzmeyer
[DNSOP] I-D Action: draft-ietf-dnsop-edns-key-tag… internet-drafts
Re: [DNSOP] I-D Action: draft-ietf-dnsop-edns-key… Bob Harold
Re: [DNSOP] I-D Action: draft-ietf-dnsop-edns-key… Edward Lewis
Re: [DNSOP] I-D Action: draft-ietf-dnsop-edns-key… Wessels, Duane