Subject: Limiting the Scope of the KEY RR

From: Edward Lewis <[email-masked]>
Date: Fri, 25 Oct 2002 11:11:57 -0400

Editorial comments:

"out" appears under the title.

Sect 2.1

"another type data" - "of" is missing.

Point 3: "They are authenticated according to different rules."  Not 
true - but "they play different roles in authentication."  I.e., as 
application keys and zone keys can be in the same set, and the set is 
authenticated together, there is no difference in the way an 
application key and a zone key are authenticated.  The difference is 
that the application key is not authorized to authenticate anything 
else - specifically a key set containing a zone key.

Explanation of point 2: "PGP key" is a misnomer. PGP certificates 
hold RSA, DSA keys (and probably others).

Explanation of point 6: In key@parent, parent would be responsible to 
hold apex application keys of child.  This is missed - that a fault 
at the parent could damage applications (even if there is no damage 
to DNS).

Last parts of Sect 3:

The term KEY is used.  Probably should be consistent and say KEY RR, 
or use the lower case key to refer to whats in the RDATA.

Sect 6 uses "KEY record" -> KEY RR.

Sect 7, IANA.  Does not mention the changes to the flag bits.
-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                          +1-703-227-9854
ARIN Research Engineer

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>