[dnsext] explicit non-support of NSEC3

["Roy Arends" <roy@nominet.org.uk>]

Andrew Sullivan wrote on 12/09/2008 03:34:21 PM:

> On Tue, Dec 09, 2008 at 02:24:10PM +1100, Mark Andrews wrote:
> 
> >         The only reason for having two numbers is if you believe
> >         there there is a reason to support validators which can do
> >         RSA/SHA-256 and not NSEC3.  I don't see a need to support
> >         that combination.
> 
> I determined during working group last call, however, that others
> _did_ see a need to support that combination.  Moreover, I buy the
> argument that we shouldn't link these two issues together.  If there
> is a validator that can't do NSEC3 and they find they suddently want
> to do SHA-2, why do we want to put an extra barrier in their way?

Such a validator _can_ implement SHA-2. Since such a validator explicitly 
does not implement NSEC3, it can now treat zones with these NSEC3 records 
as unsigned.
The method used in RFC5155 was to protect legacy validators against 
unknown extensions. Since RFC5155 is an integral part of DNSSEC, I see no 
reason to further forking the algorithm space. Imho, a validator does not 
have to understand NSEC3 to be able to validate, parse, or even signal its 
presence.

Regards,

Roy Arends
Sr. Researcher
Nominet UK

--
to unsubscribe send a message to namedroppers-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>