Subject: Re: [dane] Reopening issue #22 for discussion....

From: Peter Koch <[email-masked]>
Date: Mon, 26 Sep 2011 10:45:54 +0200

On Thu, Sep 15, 2011 at 01:23:25PM -0700, Paul Hoffman wrote:

> Current wording in the spec:
>    DNS systems conforming to this specification MUST be able to create
>    TLSA records using matching type 0 (no hash used) and matching type 1
>    (SHA-256), and SHOULD be able to create TLSA records using matching
>    type 2 (SHA-512).

this text is misleading. The draft doesn't say what it considers a "DNS system",
but to avoid ambiguity it should be clarified that there's no "conformance"
issue for the DNS name server but rather what one had in mind here is
some provisioning entity that will (be used to) feed data into the DNS zone.
The RRSet content, signed or unsigned, is transparent to the name server as
per RFC 3597.

-Peter

---

From: Paul Hoffman <[email-masked]>
Date: Mon, 26 Sep 2011 06:50:46 -0700

> this text is misleading. The draft doesn't say what it considers a "DNS system",

Good point.

> some provisioning entity that will (be used to) feed data into the DNS zone.

Correct: that's is the entity where the conformance requirement applies.

> The RRSet content, signed or unsigned, is transparent to the name server as

Yep.

Does "A system creating TLSA records that conforms to ... " work? Is there some clearer wording we can use?

--Paul Hoffman