Subject: NSEC3 Issue 20: Server behavior wrt unknown hash algorithms

From: Roy Arends <[email-masked]>
Date: Wed, 31 May 2006 17:33:06 +0200

Issue:

Server behavior with regards to unknown hash algorithms

Discussion:

An NSEC3 capable server might, on load or during a zone transfer, 
encounter an NSEC3 with an unknown hash algorithm. As it is unable to 
determine which NSEC3 to send back in a response, the server can't fully 
provide the service intended.

Approach 1)
Refuse to load/accept the zone. Return rcode 2 on requests related to this 
zone.

Approach 2)
load/accept the zone with a warning. Return rcode 2 where the responses 
normally would contain NSEC3 records. This allows the server to provide 
service for DO=0 requests, and for DO=1 where the responses do not contain 
NSEC3's

Approach 3)
Load/accept the zone with a warning. Return rcode 2 except for 
qtype=axfr/ixfr. This allows the server to provide service for 
secondaries.

This is not an exhaustive list.

Resolution:
Default approach has yet to be set.

Regards,

Roy

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>