Subject: DNSSECbis Q-17: typecode change and TKEY

From: Roy Arends <[email-masked]>
Date: Thu, 9 Oct 2003 10:00:07 +0200 (CEST)

TKEY (2930) provisions key agreement methods. One method for a resolver
and a server to agree about shared secret keying material for use in TSIG
(2845) is through DNS requests using, for example, Diffie-Hellman (DH)
Exchanged Keying.

Essentially, a resolver sends a query accompanied by a KEY RR in the
additional section specifying a resolver DH key (2539), or, a KEY
accompanied by its SIG(KEY).

The issue at hand is the accompanied KEY RR (and SIG) in light of the
recent type-code rollover, which leaves the KEY RR for the use of SIG(0)
only.

There are a few ways out:

1) retain KEY, SIG RR for the use of TKEY as well as SIG(0).
2) Have draft-ietf-dnsext-dnssec-2535typecode-change update RFC 2930 as
   well.

Either way, draft-ietf-dnsext-dnssec-2535typecode-change, and 2535bis
accordingly, has to include some text on this.

Regards,

Roy

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>