DNSSECbis Q-17: typecode change and TKEY

[Roy Arends <[e-mail]>]

TKEY (2930) provisions key agreement methods. One method for a resolver
and a server to agree about shared secret keying material for use in TSIG
(2845) is through DNS requests using, for example, Diffie-Hellman (DH)
Exchanged Keying.

Essentially, a resolver sends a query accompanied by a KEY RR in the
additional section specifying a resolver DH key (2539), or, a KEY
accompanied by its SIG(KEY).

The issue at hand is the accompanied KEY RR (and SIG) in light of the
recent type-code rollover, which leaves the KEY RR for the use of SIG(0)
only.

There are a few ways out:

1) retain KEY, SIG RR for the use of TKEY as well as SIG(0).
2) Have draft-ietf-dnsext-dnssec-2535typecode-change update RFC 2930 as
   well.

Either way, draft-ietf-dnsext-dnssec-2535typecode-change, and 2535bis
accordingly, has to include some text on this.

Regards,

Roy

--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>