Re: [dnsext] Validator assumptions: what algorithms need to properly sign a zone?

Olafur Gudmundsson <ogud@ogud.com> wrote:
> On 23/03/2012 14:23, Tony Finch wrote:
> > Olafur Gudmundsson<ogud@ogud.com>  wrote:
> > >
> > > The zone seems to be in compliance with the list in RFC4035 section 2.2
> > > i.e.
> > > there exists a valid signature by a key in the DNSKEY RRset.
> > > But in the final paragraph that seems to be contradicted and does
> > > require the a signing key for all algorithms to be in the DNSKEY RRset.
> >
> > I believe the consensus is that that requirement applies to the signer
> > not the validator.
>
> but the validator needs to take into account what the signer is
> allowed/required to do we cannot have totally disjoint
> requirements/assumptions.

They aren't disjoint. I think it makes more sense if who takes what into
account is the opposite way round to what you suggest. The validation
algorithm allows for a lot of flexibility and makes validation possible
despite some kinds of brokenness; the requirements on the signer keep it
well within the range of what validators allow. Robustness principle.

Tony.
-- 
f.anthony.n.finch  <dot@dotat.at>  http://dotat.at/
Fisher, German Bight: Northwesterly 3 or 4, increasing 5 or 6 in east Fisher.
Moderate in east Fisher, otherwise slight. Fog patches. Moderate or good,
occasionally very poor.
_______________________________________________
dnsext mailing list
dnsext@ietf.org
https://www.ietf.org/mailman/listinfo/dnsext