Subject: DS and cache transparency.

From: "Olaf M. Kolkman" <[email-masked]>
Date: Mon, 28 Oct 2002 15:31:25 +0100

I wonder if the discussion on DS and cache transparency ever was
concluded (and what the conclusion is).

The problem is that with DS a non-DNSSEC aware cache may try to query
the child zone for a DS RR. This sets architectural constraints for
deployment of DNSSEC i.e. DNSSEC aware servers throughout the line of
sight from resolver to authoritative server.

One of the proposed solutions to solve this was by performing some
label-magic so that the parent would be authoritative for the
data. e.g. by including a NULL byte in the label or by using more
comprehensible underscores. 

My question is did we ever consciously decide to live with the
architectural constraints or is there still work to do on defining the
label magic?

--Olaf

--------------------------------------------| Olaf M. Kolkman
                                            | www.ripe.net/disi

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Rob Austein <[email-masked]>
Date: Mon, 28 Oct 2002 12:22:30 -0500

> architectural constraints or is there still work to do on defining the

I'd rather live with the constraints and avoid the label voodoo.

---

From: Paul Vixie <[email-masked]>
Date: Mon, 28 Oct 2002 18:09:34 +0000

> I'd rather live with the constraints and avoid the label voodoo.

strongly agreed.

---

From: Edward Lewis <[email-masked]>
Date: Mon, 28 Oct 2002 10:44:12 -0800

>>  I'd rather live with the constraints and avoid the label voodoo.

me too
-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                          +1-703-227-9854
ARIN Research Engineer

---

From: Olaf Kolkman <[email-masked]>
Date: Mon, 28 Oct 2002 20:12:55 +0100

>>  I'd rather live with the constraints and avoid the label voodoo.

Perfect... 

Should the 'only DNSSEC in line of sight" constrain be made explicit
in the DS draft?

--Olaf

---

From: Ólafur Guðmundsson<[email-masked]>
Date: Mon, 28 Oct 2002 14:37:18 -0500

>Should the 'only DNSSEC in line of sight" constrain be made explicit

This is applies not just to DS but all DNSSEC Records and should
be mentioned in the DNSSEC-bis protocol document.

         Olafur