Subject: Re: [DNSOP] suggestion for 4641bis: key algorithm rollover section

From: Jelte Jansen <[email-masked]>
Date: Sat, 06 Sep 2008 12:16:37 +0200

Mark Andrews wrote:
> 
> What I'm getting from this is that the keyset at the apex must (at
> least) be signed by each algorithm in the DS referral, and every rrset
> in the zone must be signed by each algorithm in the apex keyset.
> 
>> 	which is referred to by a DS / trust anchor.
> 
>> 	DNSKEY's are never referenced in isolation.  There is always
>> 	a DS / trust anchor which specifies which algorithms are
>> 	in use.
> 

is that actually said anywhere in the DNSSEC RFCs?

Jelte

_______________________________________________
DNSOP mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dnsop

---

From: Jelte Jansen <[email-masked]>
Date: Sat, 06 Sep 2008 12:16:37 +0200

Jelte