Subject: Re: NSEC3 requirements question

From: Alex Bligh <[email-masked]>
Date: Thu, 04 Aug 2005 12:09:53 +0100

--On 04 August 2005 10:34 +0200 Namedroppers-owner 
<[email-masked]> wrote:

>> -- During roll between NSEC and NSEC3 (and vice-versa), must a
>>    properly configured resolver that supports both NSEC and NSEC3
>>    always see the zone as Secure (never Insecure)?
>
> This is real hard, as for this to work the zone must use both NSEC
> and NSEC3 at the same time in order to work and validator pics one
> to follow at any given moment.

I'd blithely assumed that was exactly what happened. Why is this bit hard?
(or rather why is it harder than having a resolver which supports both
NSEC plus NSEC3).

I presumed the hard bit was how to deal with potentially conflicting
NSEC/NSEC3 information (my answer: don't do that).

Alex

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>