Subject: Re: DNSSECbis Q-17: typecode change and TKEY

From: "Scott Rose" <[email-masked]>
Date: Thu, 9 Oct 2003 08:15:20 -0400

Personally, I agree with 1).  KEY could be used for transaction
authentication and DNSKEY used for generating RRSIGs only.

That way, KEY can retain the use of the DH algorithm code, and DNSKEY may
not need it.

Scott

----- Original Message ----- 
From: "Roy Arends" <[email-masked]>
To: <[email-masked]>
Sent: Thursday, October 09, 2003 4:00 AM
Subject: DNSSECbis Q-17: typecode change and TKEY

> TKEY (2930) provisions key agreement methods. One method for a resolver
> and a server to agree about shared secret keying material for use in TSIG
> (2845) is through DNS requests using, for example, Diffie-Hellman (DH)
> Exchanged Keying.
>
> Essentially, a resolver sends a query accompanied by a KEY RR in the
> additional section specifying a resolver DH key (2539), or, a KEY
> accompanied by its SIG(KEY).
>
> The issue at hand is the accompanied KEY RR (and SIG) in light of the
> recent type-code rollover, which leaves the KEY RR for the use of SIG(0)
> only.
>
> There are a few ways out:
>
> 1) retain KEY, SIG RR for the use of TKEY as well as SIG(0).
> 2) Have draft-ietf-dnsext-dnssec-2535typecode-change update RFC 2930 as
>    well.
>
> Either way, draft-ietf-dnsext-dnssec-2535typecode-change, and 2535bis
> accordingly, has to include some text on this.
>
> Regards,
>
> Roy
>
> --
> to unsubscribe send a message to [email-masked] with
> the word 'unsubscribe' in a single line as the message text body.
> archive: <http://ops.ietf.org/lists/namedroppers/>
>

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Jakob Schlyter <[email-masked]>
Date: Thu, 9 Oct 2003 16:40:26 +0200 (CEST)

> 2) Have draft-ietf-dnsext-dnssec-2535typecode-change update RFC 2930 as

I'd would go for (1) since signing transactions and rr sets have different
usages, separating the keys makes sense.

	jakob

---

From: Rob Austein <[email-masked]>
Date: Thu, 09 Oct 2003 13:45:28 -0400

> usages, separating the keys makes sense.

What Jakob said.