Subject: Re: [dnsext] Request for discussion on special dnssec processing policy.

From: Edward Lewis <[email-masked]>
Date: Wed, 1 Jun 2011 08:37:46 -0400

At 22:43 +0000 5/31/11, Roy Arends wrote:

>As an example, the CDS draft states that the CDS type MUST be signed by a
>DNSKEY with the SEP flag set.

Such a requirement is a problem.

>RFC 5395 does not address these concerns, hence my request for discussion.

How about a section on validator special processing?  That is what 
the above requirement amounts to being.

We found that trying to encode and interpret flags indicating roles 
and/or strength of keys to be problematic when doing the early 
designs of DNSSEC.  The SEP bit was defined with the understanding 
that it would never influence validation.

If this type definition wants to change that, it had better be given 
a good review.
-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis
NeuStar                    You can leave a voice message at +1-571-434-5468

Now, don't say I'm always complaining.
Wait, that's a complaint, isn't it?

---

From: Olafur Gudmundsson <[email-masked]>
Date: Wed, 01 Jun 2011 10:52:21 -0400

On 01/06/2011 8:37 AM, Edward Lewis wrote:
> How about a section on validator special processing? That is what the
> above requirement amounts to being.
>
> and/or strength of keys to be problematic when doing the early designs
> of DNSSEC. The SEP bit was defined with the understanding that it would
> never influence validation.
>
> If this type definition wants to change that, it had better be given a
> good review.

CDS is not a DNS control plane type it is an informational type for
Key/Trust-Anchor Management Systems/Components" signaling what a zone 
wants its TA's to be advertised/used as.
The presence of this type MUST NOT affect normal validation at all,
thus talking about this in a validation context is a red herring.

Normal validator ought to be "blind" to the role of this type.

	Olafur

---

From: Edward Lewis <[email-masked]>
Date: Wed, 1 Jun 2011 11:07:12 -0400

>Normal validator ought to be "blind" to the role of this type.

Proving Roy's point...need for review/discussion.
-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis
NeuStar                    You can leave a voice message at +1-571-434-5468