Subject: DNSEXT requests IETF last call on following DNSSEC documents

From: Olafur Gudmundsson <[email-masked]>
Date: Thu, 28 Mar 2002 10:31:27 -0500 (EST)

Erik,
Please start IETF last call on following DNSEXT working group
documents as soon as possible.

AD secure:
The DNSEXT working group has concluded a last call on this
document and there is consensus on advancing it.
Authors have updated the document to fix few typos and
redundant text.
http://www.ietf.org/internet-drafts/draft-ietf-dnsext-ad-secure-05.txt

Summary:
This document clarifies when a Nameserver can set this
bit. The only case when a resolver can set it is after
cryptographically verifying the data, this is a change from
RFC2535 where resolver was allowed to set the bit if data was
provably from an unsecure zone.
An authorative nameserver is allowed to be configured on a zone by
zone bases to set the AD on answers.
The document strongly recommends that resolvers ignore the bit
if the message is not from a trusted server/resolver and is
protected by message authentication.

Restrict KEY:
The DNSEXT working group has concluded a last call on this document
and there is consensus on advancing it.
Authors have updated the document, for readability and updated the
IANA consideration section to better reflect what is required of IANA.
http://www.ietf.org/internet-drafts/draft-ietf-dnsext-restrict-key-for-dnssec-02.txt

Summary:
This document redefines the use of the KEY record to be
used by DNS only. The consequence of this change is that KEY RR flags
can be greatly simplified, protocol field IANA registry can be closed.
The document does not specify how other application can use DNS to
distribute public keys.
The main reason for this change is to simplify DNS operation and avoid
packet overflows when DNSSEC keys are passed around.

Delegation Signer:
The DNSEXT working group has concluded a last call on this document
and there is consensus on advancing it.
Author has updated the document, based on comments received during
last call.
http://www.ietf.org/internet-drafts/draft-ietf-dnsext-restrict-key-delegation-signer-07.txt

Summary:
This document is a major non backwards compatible change in how chain
of trust is established in DNSSEC.  This document defines a new parent
only record DS that announces what child KEY(s) are allowed to sign
child's KEY RRset. This change is a result of operational experience.

The Opt-in document is currently in WG last call.
There will be one more small DNSSEC related document that updates
the KEY RR algorithm registry rules coming out but that is not
a big deal.

	Olafur

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>