Subject: Re: Keeping the KEY and SIG typecodes active

From: "Scott Rose" <[email-masked]>
Date: Wed, 18 Jun 2003 08:49:28 -0400

As long as the KEY RR does not have the zone key flag bit set, it should be
alright.  However, the KEY will be signed by a RRSIG in the zone, which
would cause old (RFC2535) validators to consider it unsigned.

As for SIG(0) clients, if they don't now, that doesn't mean they won't
later, especially since that was the idea of SIG(0).

Scott
----- Original Message ----- 
From: "Sam Weiler" <[email-masked]>
To: "Scott Rose" <[email-masked]>
Cc: <[email-masked]>
Sent: Tuesday, June 17, 2003 6:32 PM
Subject: Re: Keeping the KEY and SIG typecodes active

> > Topic: Keeping the KEY (typcode 24) and SIG (25) for transaction
> > authentication only.
>
> draft-ietf-dnsext-dnssec-2535typecode-change-02.txt (which finally
> cleared the i-d editor queue late this afternoon after being sent in
> on Thursday morning) keeps SIG for SIG(0), but still deprecates KEY.
> I'd appreciate it if folks would review the new sections of the draft
> -- there's a change list at the top of the document.
>
> Keeping KEY worries me a bit more, since it will appear in-zone and
> some 2535-aware things pay attention to it.  Must we really keep it?
> Do any of the SIG(0) _clients_ actually look at KEYs?
>
> -- Sam

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Sam Weiler <[email-masked]>
Date: Wed, 18 Jun 2003 15:50:14 -0400 (EDT)

> Do any of the SIG(0) _clients_ actually look at KEYs?

In thinking about this more: if a zone includes KEY RRs,

    1) there should be no bad interactions with DS-aware (and
       DNSKEY-aware) code.  DS-aware code should do the right thing
       with KEYs.

    2) if there are bad interactions with 2535-aware code, then
       those interactions are already out there -- this draft isn't
       causing them.  And if things need to be fixed later, then they
       can be fixed later.

So I see no new harm in leaving KEY for SIG(0) use.  Absent further
commentary, -03 will retain KEY for SIG(0) use only.

-- Sam