Subject: Re: new epsilon draft

From: Samuel Weiler <[email-masked]>
Date: Tue, 8 Mar 2005 15:18:26 -0500 (EST)

> A new version of the on-line signing (epsilon) draft has been
> submitted.  Major changes include examples covering the wildcard name
> and explicit verbiage relaxing constraints on the 'next name' field in
> NSEC RRs.
>
> Also available from:
>
> http://dnssec-tools.sourceforge.net/docs/draft-weiler-dnsext-dnssec-online-signing-01.txt

Two questions, which I'll ask again tomorrow morning: would the WG
like to adopt this draft as a WG work item?  Is the doc ready for WG
last call?

I have heard one broadly-supported change request, which is to
explicitly relax (or note that we're ignoring) -protocol section 2.3,
which says:

   An NSEC record (and its associated RRSIG RRset) MUST NOT be the only
   RRset at any particular owner name.  That is, the signing process
   MUST NOT create NSEC or RRSIG RRs for owner names nodes which were
   not the owner name of any RRset before the zone was signed.

I'll probably include a directive that resolvers MUST NOT reject NSEC
RR's with only RRSIG and NSEC bits set.  One alternative is to suggest
that synthesized NSEC records set another bit in the typemap (beyond
NSEC and RRSIG), but my impression is that the former solution (just
say that having only those two set is okay) is sufficient and
preferred.

-- Sam

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>