Subject: Re: DNSSECbis Q-9: Dropping SIG(NXT) in authoritative section for neg. response.

From: Bob Halley <[email-masked]>
Date: 20 May 2003 14:33:56 -0700

I support keeping the current language.

Given that we have EDNS0, I don't expect that cases where a SIG(NXT)
causes truncation will be that common.  If we don't think that the
switch to TCP is going to happen frequently, I don't think we need to
worry about it.

More importantly, separating SIGs from what they sign is something to
avoid.  Whenever you separate a SIG, you run into the possibility that
the SIG you subsequently fetch will be for another version of the
data.  When the SIG doesn't verify, the validator must not treat that
as a failure of validation, but instead must refetch both data and its
SIG and try again.

/Bob

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: [email-masked]
Date: Wed, 21 May 2003 09:54:43 +1000

> as a failure of validation, but instead must refetch both data and its
	I concur.
--
Mark Andrews, Internet Software Consortium
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

---

From: Edward Lewis <[email-masked]>
Date: Wed, 21 May 2003 13:16:22 -0400

At 14:33 -0700 5/20/03, Bob Halley wrote:
>avoid.

Very true.

Do not make separation of SIG and data an acceptable behavior by a sender.
-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                            +1-703-227-9854
ARIN Research Engineer

Your office is *not* a reality-based sit-com TV show.

---

From: Mans Nilsson <[email-masked]>
Date: Sun, 25 May 2003 09:53:06 +0200

> as a failure of validation, but instead must refetch both data and its

I agree. 
-- 
Måns Nilsson         Systems Specialist
+46 70 681 7204         KTHNOC
                        MN1334-RIPE

TONY RANDALL!  Is YOUR life a PATIO of FUN??