Re: draft-ietf-dnsext-keyrr-key-signing-flag-04.txt

[Olaf Kolkman <olaf@ripe.net>]

 * In the signer, the bit must only be used to prepare the key for 
 * exposure to the parent for DS RR processing.  (Note: I do not mean 
 * the signer must use the bit to prepare the key for sending to the 
 * parent.  I mean that the signer, if the implementation chooses to do 
 * so at all, must *only* use the bit for that purpose.)


Bind's dnssec-signzone now uses -k <KSKs> to indicate which keysigning
keys. I would love  to see the bit used so that  <KSKs> do not need to
be specified and  the -k flag (or whatever letter  you want to assign)
only is sufficient. As a result  of using the flag you would have your
pre-prepared   keysets,   epp  encapulation   or   registry  form   as
output... but that is up to the implementor and it's clients.

The draft does specifically say that the bit does NOT modify the
protocol and MUST NOT be used during verification.

 * In the key generator, the bit can be set.

That would be  handy :-).

--Olaf

--
to unsubscribe send a message to namedroppers-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>