Re: [DNSOP] On Powerbind

[Olaf Kolkman <[e-mail]>]

Looking for this: 
https://www.iana.org/assignments/dnskey-flags/dnskey-flags.xhtml ?



—Olaf

PS. Haven’t looked at this code for over a decade. That last croak, 
Postel principle violation?

On 16 Apr 2020, at 23:08, Dick Franks wrote:

> Warren,
>
> Comments in line
>
> On Thu, 16 Apr 2020 at 20:31, Warren Kumari <[e-mail]> wrote:
>> 8
>
>> Just checking - the DNSKEY Flags field is 16 bits, and we have so far 
>> burned:
>> Bit 15 - SEP
>> Bit 7 - Zone key
>> Bit 8 - Revoked
>> Did I miss any (I wasn't able to find a registry for this)?
>>
>> If not, we still have 13 bits left, and so using one for this seems 
>> ok
>> to me, especially if recursives doing something with it is 
>> optional...
>> (I had mistakenly remembered the Flags as being only 8 bits)
>> I'm still not convinced that DNSSEC Transparency will come to pass,
>> nor that many zones will use this flag, but I'm now much more 
>> sanguine
>> about giving it a bit...
>>
>
> The lack(?) of a registry is indeed regrettable.
>
> However, there seems to be some historical meaning attached to some of
> the other flag bits.
>
> If I look back at Net::DNS::SEC 0.17, bequeathed to me by one Olaf
> Kolkman, the DS create() method contains the following mysterious
> (perl) lines, for which I can offer no coherent explanation:
>
>     # The key must not be a NULL key.
>     if (($keyrr->{"flags"} & hex("0xc000") ) == hex("0xc000") ){
>         croak "\nCreating a DS record for a NULL key is illegal";
>     }
>
>     # Bit 0 must not be set.
>     if (($keyrr->{"flags"}) & hex("0x8000")) {
>         croak "\nCreating a DS record for a key with flag bit 0 set ".
>             "to 0 is illegal";
>     }
>
>     # Bit 6 must be set to 0 bit 7 must be set to 1
>     if ( ($keyrr->{"flags"} & hex("0x300")) != hex("0x100")){
>         croak "\nCreating a DS record for a key with flags 6 and 7 not 
> set ".
>             "0  and 1 respectively is illegal";
>     }
>
> which would seem to indicate that some of the other bits were thought
> to have some meaning circa 2013.
>
> Perhaps Olaf can shed some light on this topic.
>
>
> Dick Franks
> ________________________



- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Olaf M. Kolkman                                     Tweets as: @kolkman
Principal - Internet Technology, Policy, and Advocacy
Internet Society                        https://www.internetsociety.org
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -