Subject: Re: Keeping the KEY and SIG typecodes active

From: "Scott Rose" <[email-masked]>
Date: Thu, 19 Jun 2003 07:35:21 -0400

One thing I am unsure of:

Is there a widely deployed base of DS-aware resolvers out there now that
won't update with the typecode rollover?  I ask this because if a DS-aware
resolver/recursive server sees a DS, it will know to look for a KEY RR in
the child zone, and not a DNSKEY RR.

I don't think this will be a big problem at all, but thinking "that'll never
happen!"  usually comes right before the buglike alien starts chewing the
space crew...

Scott

----- Original Message ----- 
From: "Sam Weiler" <[email-masked]>
To: <[email-masked]>
Sent: Wednesday, June 18, 2003 3:50 PM
Subject: Re: Keeping the KEY and SIG typecodes active

> On Tue, 17 Jun 2003, Sam Weiler wrote:
> >
> > Keeping KEY worries me a bit more, since it will appear in-zone and
> > some 2535-aware things pay attention to it.  Must we really keep it?
> > Do any of the SIG(0) _clients_ actually look at KEYs?
>
> In thinking about this more: if a zone includes KEY RRs,
>
>     1) there should be no bad interactions with DS-aware (and
>        DNSKEY-aware) code.  DS-aware code should do the right thing
>        with KEYs.
>
>     2) if there are bad interactions with 2535-aware code, then
>        those interactions are already out there -- this draft isn't
>        causing them.  And if things need to be fixed later, then they
>        can be fixed later.
>
> So I see no new harm in leaving KEY for SIG(0) use.  Absent further
> commentary, -03 will retain KEY for SIG(0) use only.
>
> -- Sam
>
>
> --
> to unsubscribe send a message to [email-masked] with
> the word 'unsubscribe' in a single line as the message text body.
> archive: <http://ops.ietf.org/lists/namedroppers/>

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Sam Weiler <[email-masked]>
Date: Thu, 19 Jun 2003 07:55:39 -0400 (EDT)

> the child zone, and not a DNSKEY RR.

As far as I know, no.  Besides, if there were, the problem would
probably not appear at a delegation; it would appear at a secure entry
point.  ("Hey -- I have a trusted key configured for .com and the zone
doesn't have an apex KEYset.  Or SIGs.  Maybe I should SERVFAIL now.")

-- Sam

---

From: Edward Lewis <[email-masked]>
Date: Thu, 19 Jun 2003 09:57:01 -0400

At 7:35 -0400 6/19/03, Scott Rose wrote:
>won't update with the typecode rollover?

The only versions of BIND that support DS have been snapshots.  I've 
not seen any other code (non-BIND) made public that did DS.

(Anyone who uses a snapshot version of BIND in production is likely 
to buy expired milk products on a regular basis.)

>happen!"  usually comes right before the buglike alien starts chewing the

That's it, no more MST3000 episodes for you until the Vienna meetings.
-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                            +1-703-227-9854
ARIN Research Engineer

...as graceful as a blindfolded bull in a china shop...