Re: [dnsext] SIG inception/expiration

On 02/01/2012 05:46, Miek Gieben wrote:
> Hello list,
>
> A recent dnssec-deployment discussion led to the question on why the
> expiration/inception time in the RRSIG are in the "wrong" order.
>
> I did some digging in the archives and the closest I found was this:
>
> In the drafts leading up to RFC 2065, the SIG RDATA is defined:
> http://tools.ietf.org/html/draft-ietf-dnssec-secext-00#section-5.1
>
> In there it is: "time signed", "signature expiration"
>
> And then in -02 (there is no -01)
> http://tools.ietf.org/html/draft-ietf-dnssec-secext-02#section-4.1
>
> It is: "signature expiration", "time signed". Where is stays up to RFC 2065.
>

I do not remember why/if the order was changed, but seem to recall that 
my first DNSSEC code written in fall 1994 (signer) did not inter operate 
with later code (resolver spring 1995) and the reason was the order 
change and I always coded from current drafts.

> In RFC 2535 "time signed" is renamed to "signature inception", but the
> ordering isn't changed. So it's "signature expiration", "signature inception".
>
> Does anybody know (remember?) why the switch was made during
> draft-ietf-dnssec-secext-00 and -02?
>

No and I can not find version 01 anywhere.

	Olafur
_______________________________________________
dnsext mailing list
dnsext@ietf.org
https://www.ietf.org/mailman/listinfo/dnsext