Subject: Re: DNSSECbis specification glitch (type/class order reversed in signatures)

From: "Olaf M. Kolkman" <[email-masked]>
Date: Tue, 16 Mar 2004 09:36:19 +0100

Miek, Jelte, Good Catch!! 

Rob wrote: 
>  a) RFC 2535 did not explictly specify the order, but the algorithm has
>     generally been understood as signing the wire representation;

It is somewhat hidden through a refference from section 4.1.8
(Signature field):

 " RR(s) is the RRset of the RR(s)(...) in canonical form and order as
 defined in Section 8. "

RFC 2535 section 8.1 applies:

 For purposes of DNSsecurity, the canonical form for an RR is the wire
 format of the RR (...)

-- Olaf

---------------------------------| Olaf M. Kolkman
---------------------------------| RIPE NCC

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: "Olaf M. Kolkman" <[email-masked]>
Date: Tue, 16 Mar 2004 09:36:19 +0100

-- Olaf