Subject: New version of draft-ietf-dnsext-dnssec-online-signing

From: "Olaf M. Kolkman" <[email-masked]>
Date: Tue, 10 Jan 2006 09:59:23 +0100

draft-ietf-dnsext-dnssec-online-signing-01 has just been published.

The main difference between this and the previous document is that an  
applicability statement has been added. With this applicability  
statement it is thought that the underlying issue brought up during  
last call have been addressed.

Please respond before the end of this week (Friday 17:00 CET) if you  
have serious issues with this modification.

If there are no further comments the document will be published as is.

See http://tools.ietf.org/wg/dnsext/draft-ietf-dnsext-dnssec-online- 
signing/ for details.

--Olaf
   Co-Chair

-----------------------------------------------------------
Olaf M. Kolkman
NLnet Labs
http://www.nlnetlabs.nl/

---

From: Samuel Weiler <[email-masked]>
Date: Sun, 22 Jan 2006 22:10:38 -0500 (EST)

On Tue, 10 Jan 2006, Scott Rose wrote:

> I read the draft, and I don't have any issues with it going forward.
>
> I did notice that this draft is also relaxing the guidelines about the
> bitmap field of dynamicly generated NSEC RRs.  Section 3, fourth paragraph
> says:
>
>   "The generated NSEC record's type bitmap SHOULD have the RRSIG and
>    NSEC bits set and SHOULD NOT have any other bits set.  This relaxes
>    the requirement in Section 2.3 of RFC4035 that NSEC RRs not appear at
>    names that did not exist before the zone was signed."
>
> in RFC 4034 and 4035, the SHOULD(s) are MUST(s).  Perhaps another sentence
> stating that restriction is relaxed as well.

This is a tough one -- I think we wanted to leave the possibility open
for setting other bits (you could generate a SINK RR on the fly to
accomplish the same thing, right?), but still encourage generating the
NSEC and RRSIG only.

I've submitted a new version with the first SHOULD to a MUST, since I
can't think of any reason why we'd want to change that, but left the
second SHOULD (NOT).

Let me know what you think of it.

-- Sam

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: "Scott Rose" <[email-masked]>
Date: Mon, 23 Jan 2006 07:48:44 -0500

> -----Original Message-----
> From: Samuel Weiler [mailto:[email-masked]]
> Sent: Sunday, January 22, 2006 10:11 PM

>From the description, it sounds fine.  I'll read the draft and if I have a
question, I'll post.  Otherwise, I have no problem with it.  It was just the
inconsistancy I was worried about.

Scott