Subject: DNSEXT WGLC Summary: SIG(0)

From: Olafur Gudmundsson <[email-masked]>
Date: Wed, 22 Mar 2000 10:35:26 -0500

The last call period on this document has concluded. 

Only one issue was raised during the WGLC period. Currently the draft 
allows multiple SIG(0)'s to be attached to a message. There where calls
to restrict this to one SIG(0) per message. The consensus of the 
Working group is that SIG(0) MUST be restricted to one. 
The arguments against this restriction where:
1. The client does not know what algorithm the server supports
2. Allow Multiple Inheritance of capabilities to a key generated in    a
TKEY exchange. 

The working group rejects the first one as the client can query the server
for its appropriate key set and use that to select one of clients key to 
sign message. 
About the second argument there was some discussion on if this is a good
idea but because the rules governing how inheritance of capabilities is 
NOT defined yet, the working group consensus is that this is better 
to not address at this time but this issue can be revisited later in
a separate document. 

No other substantial comments where received during the last call. 

Donald please update document to reflect the WG consensus.

It is the sense of the WG that the document is ready for advancement 
and will be forwarded to IESG after update. 

There will be an opportunity to address the WG last call of this 
document in Working Group meeting in Adelaide. 

Olafur

>This is a last call on this document, SIG(0) updates RFC2535 in 
>the definition of transaction signatures. The changes are mostly 
>to make SIG(0) more like TSIG in implementation and result of 
>implementation experience. 
>SIG(0) is required for TKEY exchange when no existing shared secret
>between two DNS entities exist. 

The 

to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.