Subject: RE: the DNS/DNSSEC KEY RR debate

From: "Loomis, Rip" <[email-masked]>
Date: Sun, 4 Aug 2002 23:52:00 -0400

At 8:13 PM (by someone's clock) on 8/4/2002, someone vaguely
claiming to be Rob Austein wrote:
> At Sun, 04 Aug 2002 12:53:03 -0400, Michael Richardson wrote:
> >   Rob> There is a specific problem with using the KEY RR
> >   Rob> type for things other than DNSSEC's own internal
> >   Rob> keying.   It's called the "sub-typing problem"
> >
> >   Yes, and obsoleting KEY does nothing to solve this problem.
> Sorry, wrong.  (a) it removes the need for DNSSEC-aware resolvers
> to sift through RRsets picking out individual keys by subtype
> codes, and (b) it reduces the chances that KEY RRsets will be
> large enough to trigger DNS message truncation and fallback to
> TCP.

As a minor point of clarification, and please slap me with the
clue-by-four if I missed something, I believe that (b) is a
don't care.  Are we still considering that there's anyone out
there who intends to do DNSSEC and can't/won't support EDNS0 ???
If not, then I don't think that "fallback to TCP" is a strong
persuader...and perhaps it shouldn't be bruted about at all
for situations such as this.  "Fallback to TCP" might still
be a valid concern for other DNS enhancements/thingies, but from
everything I see it's a non-issue for DNSSEC-aware servers and
resolvers.

As I indicated, perhaps I missed something--please edu-ma-cate
me if I did and you have the time to edu-ma-cate me.  Otherwise,
I do agree with the points in your original e-mail.

  --Rip

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>