Subject: Re: Q18: TTL values for RRSIG vs. RFC2181

From: [email-masked]
Date: Sat, 01 Nov 2003 09:13:27 +1100

> At Fri, 31 Oct 2003 15:03:58 -0500, Olafur Gudmundsson wrote:
> > 
> > </chair>
> > IMHO it is more important that the RRSIG be cached for the same time
> > as the RRset it is covering, than having purity among the TTL's
> > of all the RRSIG's for one name.
> 
> <hat=just-another-bozo-on-this-bus>
> 
> I agree.  RRSIG RRs are bags hanging on the side of the covered RRset,
> and for practical purposes RRSIG RRs just don't form normal RRsets.
> 
> </hat>
> 
> > How about:
> > The TTL value of an RRSIG RR SHOULD match the TTL value of the RRset
> > it covers.  Note this may lead to an apparent violation of RFC2181
> > section 5.2, but the RRSIG is a meta type and each RRSIG is related to
> > a RRset and it is important that the RRSIG be cached for the same time as
> > the RRset covered.
> 
> <hat=editor>
> 
> I don't like "meta type" ('cause then we'd have to explain what it
> means, which would almost certainly be harder than just saying
> whatever it is that we do mean in the first place...), but I think
> that the editors can handle the wordsmithing unless the WG feels a
> strong need to constrain us to specific text.
> 
> The question before the WG is whether we've understood the content
> issue correctly.
> 
> </hat>
> 
> --
> to unsubscribe send a message to [email-masked] with
> the word 'unsubscribe' in a single line as the message text body.
> archive: <http://ops.ietf.org/lists/namedroppers/>

	The other solution to making this a exception is the SIG bit in
	the type code.

	The TTLs on SIGRR subtypes should be identical.

--
Mark Andrews, Internet Software Consortium
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: "Olaf M. Kolkman" <[email-masked]>
Date: Thu, 27 Nov 2003 10:15:15 +0100

Q18: RRsig TTL violating 2181

      Default action, based on sense of the room at IETF58 and the
      discussion on the list, is to permit the TTLs of SIGs in a SIG RRset
      (same ownername and class) to be different and to have the TTL of
      the SIG RRs bound to the TTL of the TYPE of the RR they sign.

      (Nit: this would make DNSSECbis update 2181)

      If there is no further prohibitive objections by December 8 this 
      will be taken as consensus of the working group.

-- Olaf
   DNSEXT co-chair

---------------------------------| Olaf M. Kolkman
---------------------------------| RIPE NCC