Subject: Re: Change to restrict KEY draft - dropping RRsets debate

From: Erik Nordmark <[email-masked]>
Date: Wed, 5 Jun 2002 19:13:33 +0200 (CEST)

I haven't seen any followup discussion on this, and I'm awaiting
an updated draft before I'll start the IETF last call.

In addition to the below text about "SHOULD accept" shouldn't
the document also say that name servers and resolvers MUST NOT use
KEYs with a protocol other than 3 when verifying signatures?

  Erik

> Starting with Ed's question/comment on how to best deal with "illegal" RRs
> in a potentially valid set, I am suggesting this change to the Restrict KEY
> draft:
> 
> original:
> 
> 
> Name servers and resolvers SHOULD reject any KEY with a Protocol
> other than 3.  Assignment of any future KEY record Protocol Octet
> values requires a standards action.
> 
> New:
> 
> Name servers should not load any KEY record with a protocol number other
> than 3 as authoritative data for a zone.  However, to aid backward
> compatibility, name servers and resolvers SHOULD accept any KEY with a
> Protocol
> other than 3 if received as part of a KEY RR set in a response.  Assignment
> of any future KEY record Protocol Octet values requires a standards action.
> 
> . . .
> 
> Basically stating that nameservers should check the validity (format) of the
> KEY before loading it into the database.  If an invalid KEY is detected,
> some sort of warning/error message is generated.  If an invalid KEY RR comes
> to a caching server, it should accept it as normal.  This seems (to me) to
> be the best "be conservative in what you give out, be liberal with what you
> accept" solution.
> 
> 
> Scott
> 
> 
> 
> --
> to unsubscribe send a message to [email-masked] with
> the word 'unsubscribe' in a single line as the message text body.
> archive: <http://ops.ietf.org/lists/namedroppers/>

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: "Scott Rose" <[email-masked]>
Date: Wed, 5 Jun 2002 14:01:31 -0400

I think some text about only having "dnssec" protocol keys generating and
verifying SIG records already exists in previous RFCs and also the spec
revision drafts.  Is there need to repeat it in this draft?

Scott

---

From: Erik Nordmark <[email-masked]>
Date: Thu, 6 Jun 2002 10:51:48 +0200 (CEST)

> revision drafts.  Is there need to repeat it in this draft?

I think it can't hurt to add
	Note: per RFCxxx only the DNSSEC keys are used when verifying
	...

Without this somebody might incorrectly think that the compatibilty text
implies something about the verification. 

   Erik