Subject: [dane] Using serialized DNSSEC info

From: Paul Hoffman <[email-masked]>
Date: Fri, 8 Jul 2011 13:02:21 -0700

Greetings again. Many people on the previous long thread titled "Draft for serializing DNSSEC chains" made many assumptions that were not, in fact, reflected in the draft. The biggest of these is how the serialized DNSSEC info would appear in TLS. The draft is *completely silent* on this.

If people want to discuss particular places where such info would appear in TLS and how that would related to DANE, it would be good to open individual tracker issues on it. That will, at least, help differentiate the proposal by issue number.

--Paul Hoffman

---

From: Adam Langley <[email-masked]>
Date: Fri, 8 Jul 2011 16:49:17 -0400

> Greetings again. Many people on the previous long thread titled "Draft for serializing DNSSEC chains" made many assumptions that were not, in fact, reflected in the draft. The biggest of these is h…

It has also been pointed out to me that people are questioning the
idea that a serialization persists until the first RRSIG expiry. I had
been misunderstanding their point of view. Of course, like any DNSSEC
client, freshness is only guaranteed within the window of the RRSIG,
however I will put language similar to the following in the next
draft:

"Since a serialization is effectively a DNS cache, it MUST be
regenerated based on the TTL of the records. In additional, the
serializer SHOULD refetch all records when any of them expire."

Cheers

AGL

-- 
Adam Langley [email-masked] http://www.imperialviolet.org

---

From: Paul Hoffman <[email-masked]>
Date: Fri, 8 Jul 2011 13:58:03 -0700

> serializer SHOULD refetch all records when any of them expire."

Works for me.

--Paul Hoffman