Subject: RE: NSEC2 01

From: "Scott Rose" <[email-masked]>
Date: Tue, 27 Jul 2004 12:47:33 -0400

> -----Original Message-----
> From: [email-masked]
> [mailto:[email-masked]]On Behalf Of Samuel Weiler
>
> I'm not convinced that the wildcard discussion/example is correct.
> Perhaps Ed Lewis or Bob Halley can comment?
>

The draft authors would be better able to answer, but from my take-

I'm guessing it's the part about response construction.  In the example, I
don't know why 2) non-existance of b.c.d.e. is there.  Shouldn't the EXIST
RR and subsequent NSEC2 RR show who the closest encloser is?  That's how the
current DNSSECbis spec does it.  The server only needs to provide:

1.  proof that the exact name doesn't exist
2.  proof that there isn't a wildcard at the closest encloser.  One that
could have been expanded to provide a postive response.

In this case, there is a EXIST RR to show the closest encloser.  In some
cases, that isn't necessary, as there will be RRs at the closest encloser.

Scott

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>