Subject: Re: [dnsext] NSEC and algo 7 - dnssec-bis updates

From: Samuel Weiler <[email-masked]>
Date: Mon, 8 Mar 2010 04:13:56 -0500 (EST)

[ Moderators note: Post was moderated, either because it was posted by
   a non-subscriber, or because it was over 20K.  
   With the massive amount of spam, it is easy to miss and therefore 
   delete relevant posts by non-subscribers. 
   Please fix your subscription addresses. ]

>> I propose to add text to dnssec-bis updates for this:
>>    DNSKEY algorithm identifiers DSA-NSEC3-SHA1[6] and
>> RSASHA1-NSEC3-SHA1[7] may be used with NSEC or NSEC3 for secure denial.
>
> 	DSA-NSEC3-SHA1 and RSASHA1-NSEC3-SHA1 signal that the zone
> 	MAY be using NSEC3, rather than NSEC, for negative validation.

Thanks to Wouter for suggesting this and Mark for the language.  A 
clarification (reworded) will be present in 
draft-ietf-dnsext-dnssec-bis-updates-10.

-- Sam (as editor)