Subject: Re: Q-24 DNSKEY with flag 7=0 not to be used with DNSSEC.

From: "Scott Rose" <[email-masked]>
Date: Tue, 10 Feb 2004 14:05:22 -0500

I am not sure we need this text added.  Later in the text, when discussing
the authentication proceedure for data, it clearly states that any DNSKEY
used to verify RRSIGs must have its zone bit flag set to one.

We can add it again to section 2.1, but that statement is already made where
it counts in the section dealing with response authentication.

Scott

----- Original Message ----- 
From: "Olaf Kolkman" <[email-masked]>

>
> The behavior for the flag bit (bit7) in the DNSKEY RR set to 0 is not
> specified. We propose the following text to be added to section 2.1:
> DNSKEY RRs MUST NOT be used for DNSSEC validation if bit 7 of the flag
> field is set to 0.
>
>
> --Olaf
>
>
> --
> to unsubscribe send a message to [email-masked] with
> the word 'unsubscribe' in a single line as the message text body.
> archive: <http://ops.ietf.org/lists/namedroppers/>
>

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Ólafur Gudmundsson/DNSEXT co-chair <[email-masked]>
Date: Thu, 12 Feb 2004 23:26:49 -0500

>DNSKEY RRs MUST NOT be used for DNSSEC validation if bit 7 of the flag

This question is closed with the default action, Editors please
add this text.

         Ólafur