Subject: Revised list of DNSSECbis spec questions

From: "Scott Rose" <[email-masked]>
Date: Thu, 10 Jul 2003 13:16:16 -0400

Just to remind everyone before the WG meetings, here is the collection of
DNSSECbis questions posed to the list.  This is to the best of my knowledge,
so there may be errors.

Q1 - resolved

Q2 - Should we move DSA to "optional" and have RSA/SHA1 be the only
mandatory to implement algorithm?
*Consensus? *

Q3 - Can we drop the requirement to add the KEY/SIG(KEY) to the additional
section of a response?
*Consensus seems to be in favor of dropping requirement*

Q4 - mistake in numbering, there is no Q4

Q5 - Should algorithm code 252 (now "Indirect") remain, or move it to
"Reserved"?
*Consensus? Could not find any resolution in archives *

Q6 - Started as "Should sec-aware resolvers cache known "BAD" data"? but
now encompasses how servers/resolvers should interpret the CD bit in the DNS
header.
* No formal consensus reached yet, discussion died out *

Q7-  Should the DNSSECbis documents discuss use of preconfigured trusted
   DSs in addition to to preconfigured trusted KEYs?

Q8 - Should the apex allow zone KEY RRs only?
*Consensus seems to be no restrictions at all on KEY RR placement in
a zone *

Q9 - Dropping the SIG(NXT) from the NXT RRs included in the Auth. section on
wildcard and negative replies
*Consensus seems to be no allowing of NXT/SIG(NXT) breakup in
authority section. Truncate response *

Q10:  Reaction to "Silly NXT".  NXT's that do not have the NXT and/or SIG
bit set
in bitmap.

Q11:  KEY RRs allowed at delegation points.
      "Consensus:  not really."  Seems to be more "no" than "yes" though.

Scott

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>