Re: [dnsext] I-D Action: draft-ietf-dnsext-dnssec-algo-signal-04.txt

[ Quoting <scottr.nist@gmail.com> at 09:08 on Mar 12 in "Re: [dnsext] I-D Act..." ]
> One reason we made it three unique options was so clients could mix
> and match if they wanted. Especially since there is only one NSEC3
> hash algorithm code assigned for now.

Upgrading hashes in NSEC3 is hard, upgrading NSEC3 (to whatever) is harder
still.

How about an extra option that lists which authenticated denial of existence
records are understood. Something along the lines:

An option code that signals which negative resource records an resolver
can handle. When DNSSEC was first designed NXT, was defined, this was
later renamed to NSEC. Later still NSEC3 was defined. Upgrading to a new
authenticated denial of existence record is very hard. The upgrade to NSEC3
involved an algorithm roll, which is not desirable as we only have 8 bits in
the algorithm field. So we define to following:

NXU                         (NXDOMAIN Understood)
2                           (length is always 2 octect)
Type code of the highext NX 
record understood.

This defaults to '50'.

 Regards,

-- 
    Miek Gieben

Re: [dnsext] I-D Action: draft-ietf-dnsext-dnssec-algo-signal-04.txt

Attachment: signature.asc