Subject: Re: DNSSEC protocol doc question: pre-conf keys.

From: Miek Gieben <[email-masked]>
Date: Wed, 2 Apr 2003 13:21:51 +0200

[On 31 Mar, 2003, Paul Vixie wrote in "Re: DNSSEC protocol doc question: p ..."]
> > I could see where a zone would want to have the secure entry point offline.
> > The root zone could publish the key somewhere else, to reduce response
> > sizes, for example.  Otherwise, it seems a bit self-defeating.
> 
> agreed.
> 
> > Is there a reason for stating that a zone MUST have its secure entry point
> > key in the served zone?
> 
> not in my view.  this appears to be an overspecification.

so If we allow the change from MUST to SHOULD in section 2.1:
        ...A signed zone MUST have at least one zonekey...
to
        ...A signed zone SHOULD have at least one zonekey...

Then we allowing keyless zones? That is zones with out any zone KEY material
in it, only signatures.

If so, section 5. Authenticating DNS Responses, must also be changed.
The first step "Verify that the initial KEY RR appears in the apex KEY
RRset" is nonsense. (maybe other sections must also be changed)

grtz Miek

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Ólafur Guðmundsson <[email-masked]>
Date: Fri, 04 Apr 2003 16:57:56 -0500

>RRset" is nonsense. (maybe other sections must also be changed)

IMHO I think the MUST is the right way to go.
If the zone signing key is not available the zone can only be verified
by resolvers that have that key configured. This will not scale outside
a small test environment.

         Olafur