Re: [dnsext] Validator assumptions: what algorithms need to properly sign a zone?

Reordering Olafur's message.

On Fri, 23 Mar 2012, Olafur Gudmundsson wrote:

> Fundamental question:
> What algorithms can a validator use to validate records from a zone
>  1) only algorithms in DS RRset
>  2) any algorithm in the validated DNSKEY RRset

I'm not sure how you got to that as the final question, but it's an 
easy one to answer: #2.  We decided to have algorithm signalling 
happening in BOTH the DS RRset and the DNSKEY RRset.  The DNSKEY RRset 
can add algorithms but not remove them.

It sounds like what you're trying to ask, though, is "MUST a resolver 
try all algorithms, even to the point of jumping between algorithms?". 
bis-updates 5.4 says SHOULD, not MUST, without explictly saying 
anything about jumping between algorithms.

There is going to be unpredictability in this case.  Some resolvers 
won't support B, whether through implementation choice or 
configuration choice (B might be weak, hence turned off).  And it's 
probably sane, though certainly not necessary, for a validator to 
impose a no-alogrithm-jumping rule.  Hence limiting 5.4 to a SHOULD, 
not a MUST.

> Doodle poll available at:
> 	http://www.doodle.com/7v5vmzvaerb2n8sb

A Doodle poll seems like a poor tool for something such as this.

> Section 5.11 of dnssec-bis seems to strongly say that any algorithm in the 
> DNSKEY should work:
>    without saying what to do if not all the algorithms are supported
> or  that at least one algorithm in the DS MUST work.

Both this and 4035 section 2.2 may not explicitly say "and the chain 
of trust has to work within each algorithm".  Is that not said or 
implied elsewhere?  Are these sections really so ambiguous that we 
need to clarify them?

Please re-read bis-updates 5.11 and ponder.

-- Sam
_______________________________________________
dnsext mailing list
dnsext@ietf.org
https://www.ietf.org/mailman/listinfo/dnsext