Subject: [dnsext] Indicating BNAME support via DNSKEY algorithm values

From: Chris Thompson <[email-masked]>
Date: 28 Apr 2010 21:45:20 +0100

I am having a great deal of difficulty in seeing how this can possibly
work in practice.

Presumably the *-BNAME versions of the algorithms would only be enabling -
"there *may* be BNAMEs" - so if a zone is signed with (say) both RSASHA256
and RSASHA256-BNAME, it can't actually have any BNAMEs.

So in order to put a BNAME into your zone, you have to sign it *only*
with algorithms which a substantial proportion of the validating
community do not yet support. Why would anyone do that, when there
are other methods (if less graceful) of achieving the same effect?

Consider the root zone, post 2010-07-01. Would the relevant authorities
really switch algorithms, and promulgate a new root trust anchor, just
in order to have BNAMEs in the root zone? It seems extraordinarily
unlikely! They would take the easier line of having duplicate delegations
instead (i.e. offload the problem onto someone else).

The *-NSEC3 algorithm values really only worked because DNSSEC was so
little deployed at that stage, and those insisting on NSEC3 were such
significant players in the deployment effort.

-- 
Chris Thompson               University of Cambridge Computing Service,
Email: [email-masked]    New Museums Site, Cambridge CB2 3QH,
Phone: +44 1223 334715       United Kingdom.

---

From: Mark Andrews <[email-masked]>
Date: Thu, 29 Apr 2010 07:31:52 +1000

In message <[email-masked]>, Chris Tho
> significant players in the deployment effort.

DNSSEC is still so little deployed and unfortunately will be for
quite a while yet.

Even if there was near ubiquitious deployment that is still not a
reason to not develop and deploy BNAME capable server and validators.
Some zones would not switch fast others would.   The functionality
is needed and not all use cases have alternate solutions.

Mark
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]