Subject: question on draft-josefsson-rfc2538bis-00

From: "Scott Rose" <[email-masked]>
Date: Fri, 5 Nov 2004 10:18:55 -0500

Reading over the drafts on the DNSEXT agenda for next week, I have a
question on the algorithm field of the CERT RDATA:

Section 2 says that if the algorithm of the key in the CERT RR is not
defined in DNSSEC, to use RESERVED (0).  I was wondering why this choice was
made and not the PRIVATEDNS code (253)?   There is a private code defined
for the certificate type field.

Scott

****************************************
Scott Rose
Adv. Network Tech. Div., NIST
+1 301-975-8439

http://www-x.antd.nist.gov/dnssec/
****************************************

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Simon Josefsson <[email-masked]>
Date: Fri, 05 Nov 2004 16:49:35 +0100

> for the certificate type field.

I don't know more than what's in RFC 2538.  Donald?  Olafur?

PRIVATEDNS does not seem appropriate, draft-ietf-dnsext-dnssec-records:

   Algorithm number 253 is reserved for private use and will never be
   assigned to a specific algorithm.  The public key area in the DNSKEY
   RR and the signature area in the RRSIG RR begin with a wire encoded
   domain name, which MUST NOT be compressed.

That doesn't match the RRDATA specified in RFC 2538.

However, using PRIVATEOID (254) might be appropriate for the X.509
certificate and CRLs, since they are prefixed with an OID.  However
that would not be compatible with RFC 2538.

Thanks,
Simon