Subject: Current status of DNSSECbis questions -

From: "Scott Rose" <[email-masked]>
Date: Mon, 14 Jul 2003 16:10:37 -0400

Below is the same question list I sent out last week, but with the status
of discussion (CLOSED or not).  And if it is closed, or no longer relevant
(see below), the reason why.

Q1 -  CLOSED resolved

Q2 - Should we move DSA to "optional" and have RSA/SHA1 be the only
mandatory to implement algorithm?
*Consensus? *

Q3 - Can we drop the requirement to add the KEY/SIG(KEY) to the additional
section of a response?
*CLOSED:  Consensus seems to be in favor of dropping requirement*

Q4 - mistake in numbering, there is no Q4

Q5 - Should algorithm code 252 (now "Indirect") remain, or move it to
"Reserved"?
*CLOSED:  Consensus - Obsoleted by typecode rollover.  Useless since there
is still
  no draft describing its use.  DNSKEY and KEY would have to have differing
IANA algorithm registries.

Q6 - Started as "Should sec-aware resolvers cache known "BAD" data"? but
now encompasses how servers/resolvers should interpret the CD bit in the DNS
header.
* No formal consensus reached yet, discussion died out *

Q7-  Should the DNSSECbis documents discuss use of preconfigured trusted
   DSs in addition to preconfigured trusted KEYs?
*CLOSED:  consensus is:  sure, why not?  *

Q8 - Should the apex allow zone KEY RRs only?
*CLOSED:  Consensus seems to be no restrictions at all on KEY RR placement
in
a zone *  besides, DNSKEY are the zone keys now.

Q9 - Dropping the SIG(NXT) from the NXT RRs included in the Auth. section on
wildcard and negative replies
*CLOSED:  Consensus seems to be no allowing of NXT/SIG(NXT) breakup in
authority section. Truncate response *

Q10 - Silly state - some further elaboration and text will be presented to
the list at a later date.

Q11 - KEY RRs at delegation point.
CLOSED:  DNSKEY/KEY would be glue.  Not a DNSSEC issue about what to allow
as non-auth glue.  Local policy about serving and accepting unsigned data
would dictate.

Scott

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>