IETF Logo Mail Archive

Re: [dnsext] Validator assumptions: what algorithms need to properly sign a zone?

Tony Finch <dot@dotat.at> Fri, 23 March 2012 18:23 UTC

Return-Path: <dnsext-bounces@ietf.org>
X-Original-To: namedroppers-archive-gleetwall6@lists.ietf.org
Delivered-To: ietfarch-namedroppers-archive-gleetwall6@ietfa.amsl.com
Received: from ietfa.amsl.com (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F1F4A21F8501; Fri, 23 Mar 2012 11:23:57 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1332527038; bh=kgE1zo96aimnqcv+GQein0+2ecigR8J/Prp19pjkLhg=; h=Date:From:To:In-Reply-To:Message-ID:References:MIME-Version:Cc: Subject:List-Id:List-Unsubscribe:List-Archive:List-Post:List-Help: List-Subscribe:Content-Type:Content-Transfer-Encoding:Sender; b=LUNvtXJN55LL2WtdgwRCj/uT/NZV6E2yBrPG8ZiN1JfuFvKJu3ODX7zg4eAgNhRt9 2EUOsItqvbC5rwbMEZfUfW0DKKynWwSVj8Yuo7uk+ICumiWMM3E+b7Avfr/ylGMYaH xZQAac6xM9su2hcS2CUQfmYJ3WRlKElESrUnoEaI=
X-Original-To: dnsext@ietfa.amsl.com
Delivered-To: dnsext@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C44EB21F84E1 for <dnsext@ietfa.amsl.com>; Fri, 23 Mar 2012 11:23:55 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -6.477
X-Spam-Level:
X-Spam-Status: No, score=-6.477 tagged_above=-999 required=5 tests=[AWL=0.122, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Sm+GPfaqsjCn for <dnsext@ietfa.amsl.com>; Fri, 23 Mar 2012 11:23:51 -0700 (PDT)
Received: from ppsw-50.csi.cam.ac.uk (ppsw-50.csi.cam.ac.uk [131.111.8.150]) by ietfa.amsl.com (Postfix) with ESMTP id 80EE621F84F2 for <dnsext@ietf.org>; Fri, 23 Mar 2012 11:23:51 -0700 (PDT)
X-Cam-AntiVirus: no malware found
X-Cam-SpamDetails: not scanned
X-Cam-ScannerInfo: http://www.cam.ac.uk/cs/email/scanner/
Received: from hermes-2.csi.cam.ac.uk ([131.111.8.54]:53212) by ppsw-50.csi.cam.ac.uk (smtp.hermes.cam.ac.uk [131.111.8.157]:25) with esmtpa (EXTERNAL:fanf2) id 1SB99R-0004Cj-rj (Exim 4.72) (return-path <fanf2@hermes.cam.ac.uk>); Fri, 23 Mar 2012 18:23:49 +0000
Received: from fanf2 (helo=localhost) by hermes-2.csi.cam.ac.uk (hermes.cam.ac.uk) with local-esmtp id 1SB99R-0002G1-It (Exim 4.67) (return-path <fanf2@hermes.cam.ac.uk>); Fri, 23 Mar 2012 18:23:49 +0000
Date: Fri, 23 Mar 2012 18:23:49 +0000
From: Tony Finch <dot@dotat.at>
X-X-Sender: fanf2@hermes-2.csi.cam.ac.uk
To: Olafur Gudmundsson <ogud@ogud.com>
In-Reply-To: <4F6C99CB.7080806@ogud.com>
Message-ID: <alpine.LSU.2.00.1203231822280.24583@hermes-2.csi.cam.ac.uk>
References: <4F6C99CB.7080806@ogud.com>
User-Agent: Alpine 2.00 (LSU 1167 2008-08-23)
MIME-Version: 1.0
Cc: "<dnsext@ietf.org>" <dnsext@ietf.org>
Subject: Re: [dnsext] Validator assumptions: what algorithms need to properly sign a zone?
X-BeenThere: dnsext@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: DNS Extensions working group discussion list <dnsext.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsext>, <mailto:dnsext-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/dnsext>
List-Post: <mailto:dnsext@ietf.org>
List-Help: <mailto:dnsext-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsext>, <mailto:dnsext-request@ietf.org?subject=subscribe>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: dnsext-bounces@ietf.org
Errors-To: dnsext-bounces@ietf.org

Olafur Gudmundsson <ogud@ogud.com> wrote:
>
> The zone seems to be in compliance with the list in RFC4035 section 2.2 i.e.
> there exists a valid signature by a key in the DNSKEY RRset.
> But in the final paragraph that seems to be contradicted and does
> require the a signing key for all algorithms to be in the DNSKEY RRset.

I believe the consensus is that that requirement applies to the signer
not the validator.

> What algorithms can a validator use to validate records from a zone
>   2) any algorithm in the validated DNSKEY RRset

Tony.
-- 
f.anthony.n.finch  <dot@dotat.at>  http://dotat.at/
Portland: Mainly easterly 3 or 4, occasionally 5 later. Smooth or slight,
occasionally moderate later. Fog patches. Good, occasionally very poor.
_______________________________________________
dnsext mailing list
dnsext@ietf.org
https://www.ietf.org/mailman/listinfo/dnsext

v2.23.0 | Report a Bug | By Email