Subject: Comment on draft-ietf-dnsext-dnssec-records

From: Simon Josefsson <[email-masked]>
Date: Sat, 03 Aug 2002 00:15:19 +0200

(I forgot which list you were supposed to send comments on this draft
to, perhaps it would make sense to mention the list in the draft. Feel
free to forward this wherever appropriate.)

Tracking down the CERT RR's algorithm field's mnemonic names, I find
in RFC 2538:

,----
|    The algorithm field is represented as an unsigned integer or a
|    mnemonic symbol as listed in [RFC 2535].
`----

Since I gather draft-ietf-dnsext-dnssec-records-01 is replacing RFC
2535, I read it instead and find:

,----
|    The Algorithm Field is represented as an unsigned integer or as
|    mnemonic specified.  The mnemonic is listed in the document defining
|    the algorithm.
| ...
|    VALUE   Algorithm                   RFC          STATUS
|     0      Reserved                    -            -
|     1      RSA/MD5                     RFC 2536     NOT RECOMMENDED
                                                ^ this should be RFC 2537
|     2      Diffie-Hellman              RFC 2539     OPTIONAL
|     3      DSA                         RFC 2536     MANDATORY
|     4      elliptic curve              Work in Progress
|     5      RSA/SHA1                    RFC 3110     MANDATORY
|     6-251  available for assignment    -
|     252    reserved                    -            indirect keys
|     253    private                     -            domain name
|     254    private                     -            OID
|     255    reserved                    -            -
`----

But looking into these RFCs for the mnemonic name isn't very
enlightening:

RFC 2536, 2537 and draft-ietf-dnsext-ecc-key do not seem to include a
mnemonic, although a table in RFC 2535 covers for them.  The table
isn't present in draft-ietf-dnsext-dnssec-records though.

RFC 3110 doesn't include a mnemonic, and the KEY RR algorithm field
value used (5) there isn't in the table in RFC 2535 either.

The mnemonic names used in the text representation of DNSSEC RR's
seems to just have vanished.  Or my grepping capabilities are poor.

IMO draft-ietf-dnsext-dnssec-records should include a chapter "ASCII
Representation of Security RRs" like the one in RFC 2535 and not defer
the mnemonic to other documents, as it is clear that those other
documents don't contain the answer.

IMO2 draft-ietf-dnsext-dnssec-records should contain CERT too.  Taking
RFC 2538 and fixing a few unclear spots (e.g., whether the PGP CERT
RRDATA should include the checksum field or not) should be sufficient.
I'll volunteer to do it if human resources is the limiting factor.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>