Subject: Terminology question

From: Olafur Gudmundsson <[email-masked]>
Date: Fri, 30 Apr 1999 09:39:31 -0400

The following question has come up in the creation of documentation for
BIND and presentations about security enhancements in BIND. 

Q: What is DNSSEC ? 

The DNSSEC core documents RFC2335-7 cover the use of KEY, SIG, NXT records,
using DSS and RSA. 

My coworkers and I use the DNSSEC to cover the use of KEY, SIG, NXT and
TSIG records.

In our mind TSIG is a complementary and necessary security enhancement for DNS.

Does anyone have a problem of considering TSIG as a subset of DNSSEC ? 

CERT record is also considered as part of DNSSEC even if it is not used by
DNSSEC. 

	Olafur

ps: Silence will be taken as an acceptance

----------------------------------------------------
Olafur Gudmundsson 	    		[email-masked]  (work)
443-259-2389 (NEW PHONE NUMBER)	[email-masked]   (private)
301-854-6889  x2389 (if you can not dial 443 area code)

---

From: John Gilmore <[email-masked]>
Date: Fri, 30 Apr 1999 10:35:34 -0700

> Does anyone have a problem of considering TSIG as a subset of DNSSEC ? 

I do have a problem considering TSIG as a part of DNSSEC.

> CERT record is also considered as part of DNSSEC even if it is not used by

I also have a problem with gluing the useless CERT record into DNSSEC.
It's an individual proposal by the prolific Don Eastlake.

	John