Subject: Re: preconfigured keys or ds's

From: Edward Lewis <[email-masked]>
Date: Tue, 1 Apr 2003 09:41:55 -0500

I really think this is an implementation-by-implementation decision. 
At best, an information RFC describing your experiences in developing 
running code.

At 15:29 +0200 3/31/03, Miek Gieben wrote:
>Hello,
>
>I would like to see the following documented, but I don't know for sure
>if it is a dnssec or dnsop issue:
>
>The preconfigured keys for resolvers are large and are hard to compare
>and read (by humans). DS records on the other hand are much smaller
>and easier to handle. I think it would be better to preconfigure
>DS records in stead of zone keys for resolvers. This is also how
>my perl resolver works.
>
>Where to put this? In the dnssec drafts or in a seperate dnsop BCP?
>
>grtz  Miek

-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                            +1-703-227-9854
ARIN Research Engineer

I've had it with world domination.  The maintenance fees are too high.
#----------------------------------------------------------------------
# To unsubscribe, send a message to <[email-masked]>.

---

From: Rob Austein <[email-masked]>
Date: Tue, 08 Apr 2003 21:55:56 -0400

Almost lost this one under other traffic.

> DS records in stead of zone keys for resolvers. This is also how

<hat dnsop-wg-co-chair=off dnssec-editors-team-member=off>

  This sounds like a reasonable implementation choice.

</hat>

> Where to put this? In the dnssec drafts or in a seperate dnsop BCP?

<hat dnsop-wg-co-chair=off dnssec-editors-team-member=on>

  The current DNSSECbis drafts don't talk about using trusted DS RRs
  as a starting point, only trusted KEYs.  Given the last paragraph of
  section 2.4.1 of draft-ietf-dnsext-delegation-signer-13.txt, this
  looks like an oversight (probably mine, since I was probably the
  last person to work on the relevant text in the DNSSECbis drafts).

  So the DNSSECbis spec needs fixing, and I don't expect anybody to
  argue against the fix, but for process reasons it'd be best to post
  an explanation to namedroppers first, so I'll do that.

</hat>

<hat dnsop-wg-co-chair=on dnssec-editors-team-member=off>

  Because of the above, at least part of this is a DNSEXT issue.

</hat>