Subject: Re: draft-ietf-dnsext-keyrr-key-signing-flag-04.txt

From: Edward Lewis <[email-masked]>
Date: Mon, 23 Dec 2002 09:08:02 -0500

At 8:45 +1100 12/23/02, [email-masked] wrote:
>	There is no benefit in a KSK if a KSK signs the entire zone.

The topic here isn't a "KSK" but a "bit to indicate that this is 
intended to be a key-signing key."

I've not been persuaded to make a formal distinction between a ZSK 
and KSK within the protocol.  I have been persuaded to indicate the 
intent of the key manager to use a key as "one that is to be 
referenced by a DS RR."

 From discussions held over the past year, the sentiment has been that 
this bit is intended to help applications differentiate on key 
management and to help the manual process of key management.  The bit 
is not intended as a in-protocol policy tool.  I.e., as far as the 
in-band protocol is concerned, the distinction between KSK and ZSK is 
not made.

-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                          +1-703-227-9854
ARIN Research Engineer

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: "Scott Rose" <[email-masked]>
Date: Mon, 23 Dec 2002 09:12:58 -0500

<snip>
> >
> > In "whatever-generates the DS RR from the KEY RR" may read the bit to
> > determine that this is a key for which a DS is desired.
> >
> > As for why "Agggh NO!!": what if the child zone has just one key?
> > That key is both the KSK (needs DS) and ZSK.
>
> Then you don't set KSK in the first place or you tell the
> signer to ignore the KSK and use the key to sign all the
> data sets.
>
> A KSK key is by definition a KEY that *only* signs the zone
> key.
>

Correct, but if the admin is stupid enough to sign a zone with a KSK, and
not include a zone key (ie. the zone key has the KSK bit set).  The admin
shouldn't be punished.

After the signer is done - the KSK bit loses all meaning.  The resolver,
verifier and servers should not assigning any specially meaning to the KSK
on a KEY RR.

> > Another reason to not do this: Please don't repeat the mistake of the
> > A/C bits of the 2535 flags field - the "authentication prohibited"
> > and "confidentiality prohibited" goof ups.
>
> This a flag to tell the signer what to do.  It is NOT
> enforced by the resolver.
>

Correct again.  This bit is signer-meaningful only.

> Mark Andrews, Internet Software Consortium
> 1 Seymour St., Dundas Valley, NSW 2117, Australia
> PHONE: +61 2 9871 4742                 INTERNET: [email-masked]
>

Scott