Subject: [dnsext] NSEC and algo 7 - dnssec-bis updates

From: "W.C.A. Wijngaards" <[email-masked]>
Date: Thu, 12 Nov 2009 09:51:34 +0100

Hi,

RFC5155(NSEC3) defines new algorithms as aliases for old DSA and RSASHA1 
to help backwards compatibility from old NSEC-only servers to servers 
that are NSEC3-aware.  (these two are DSA-NSEC3-SHA1[6] and 
RSASHA1-NSEC3-SHA1[7]).

 From my recollection I know that both NSEC and NSEC3 are accepted for a 
zone signed with algo 6 or 7.  RFC5155 does not make a straight 
statement about this.  (it also does not say that nsec with algo7 is 
bogus).  Since the original reason was to signal nsec3-understanding, it 
is more lenient to accept both nsec and nsec3 for these algorithm 
identifiers.

I propose to add text to dnssec-bis updates for this:
   DNSKEY algorithm identifiers DSA-NSEC3-SHA1[6] and 
RSASHA1-NSEC3-SHA1[7] may be used with NSEC or NSEC3 for secure denial.

Best regards,
    Wouter

---

From: Mark Andrews <[email-masked]>
Date: Fri, 13 Nov 2009 01:59:15 +1100

> RSASHA1-NSEC3-SHA1[7] may be used with NSEC or NSEC3 for secure denial.

	DSA-NSEC3-SHA1 and RSASHA1-NSEC3-SHA1 signal that the zone
	MAY be using NSEC3, rather than NSEC, for negative validation.
 
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]