[dnsext] Validator assumptions: what algorithms need to properly sign a zone?

Following configuration was detected in the wild recently:
Notation: A is algorithm x
	  B is algorithm y
	  An is key n of algorithm A

Parent:
	DS   1 A1
	DS   2 A1

Child:
	DNSKEY A1,B1      signed by A1 and B1
	SOA               signed by A1 and B1
	all other records signed by A2 and B1

Notice that A2 signs records w/o being in the DNSKEY RRset.

Some validators returned AD others return SERVFAIL for the RRsets signed 
by A2 + B1.
The validators that return AD make the jump from algorithm A to B when 
validating the zone, the ones that SERVFAIL expect that the zone be 
properly signed by algorithm A (which it is not).

Both positions are arguable, but it is bad for resolver vendors to be 
put in this position to argue with customers why they disagree on the 
right answer, and DNSSEC operators need a strong message what is allowed.

In the case of a validator that supports A but not B SERVFAIL is the 
right answer as the zone is not properly signed for that algorithm.
In this particular case the validators supported both algorithms.

Background:
The zone seems to be in compliance with the list in RFC4035 section 2.2 
i.e. there exists a valid signature by a key in the DNSKEY RRset.
But in the final paragraph that seems to be contradicted and does
require the a signing key for all algorithms to be in the DNSKEY RRset.

Section 5.4 of dnssec-bis seems skirts on this issue.
Section 5.11 of dnssec-bis seems to strongly say that any algorithm in 
the DNSKEY should work:
     without saying what to do if not all the algorithms are supported
or  that at least one algorithm in the DS MUST work.

Some people in this working group have argued that use/order of 
algorithms should be local policy and it is outside the documents scope 
to talk about this, others argue that will lead to unpredictability in 
resolution status.

Fundamental question:
What algorithms can a validator use to validate records from a zone 	
   1) only algorithms in DS RRset
   2) any algorithm in the validated DNSKEY RRset

Doodle poll available at:
	http://www.doodle.com/7v5vmzvaerb2n8sb

Please fill in the poll, chairs will judge if any changes are needed in 
DNSSECbis.

	Olafur
_______________________________________________
dnsext mailing list
dnsext@ietf.org
https://www.ietf.org/mailman/listinfo/dnsext