Re: [dnsext] SIG inception/expiration

On Mon, Jan 02, 2012 at 03:03:38PM +0100, Miek Gieben wrote:
> [ Quoting <marka@isc.org> at 00:52 on Jan  3 in "Re: [dnsext] SIG inc..." ]
> > 
> > In message <20120102104613.GB12764@miek.nl>, Miek Gieben writes:
> > > Hello list,
> > > 
> > > A recent dnssec-deployment discussion led to the question on why the
> > > expiration/inception time in the RRSIG are in the "wrong" order.
> > 
> > Actually the order makes lots of sense.  Expiration time is almost
> > always the critical value in a signature.  Inception time is almost
> > always in the past.  One could completely remove inception time
> > and still have secure signatures.
> 
> But was this the original reason to change the order?
> 
> And someone, not trained in the Jedi ways of DNSSEC, will look at an RRSIG and
> assume the first time stamp is the inception and the second one is expiration.
> 
>  grtz,
> 
> -- 
>     Miek

it is possible to publish multiple sigs at the same time but covering different
intervals.  marks simplistic pov presumes that a sig is active when it appears.
as for ordering, Ed may chime in anyday now...

/bill

> _______________________________________________
> dnsext mailing list
> dnsext@ietf.org
> https://www.ietf.org/mailman/listinfo/dnsext

_______________________________________________
dnsext mailing list
dnsext@ietf.org
https://www.ietf.org/mailman/listinfo/dnsext