draft-weiler-dnsext-dnssec-2535-compat-00.txt

[Sam Weiler <weiler@tislabs.com>]

This document describes a solution to a backwards incompatibility
problem between DS and resolvers that understand RFC2535.  The
proposed solution of rolling the DNSSEC RR type codes has been
implemented and received some testing at the opt-in workshop at RIPE
in January (see Olaf's message of 5 Feburary and the ensuing
discussion).  The same problem may be triggered when legacy resolvers
see proofs of delegations being in insecure spans using opt-in,
but this has not been tested.

This problem was diagnosed by Jakob Schlyter and Mark Andrews earlier
this year, though it probably caused some of the misbehavior seen on
testbeds and in workshops last year.

-- Sam

---------- Forwarded message ----------
Date: Thu, 27 Feb 2003 07:43:48 -0500
From: Internet-Drafts@ietf.org
To: IETF-Announce:  ;
Subject: I-D ACTION:draft-weiler-dnsext-dnssec-2535-compat-00.txt

A New Internet-Draft is available from the on-line Internet-Drafts directories.


	Title		: Legacy Resolver Compatibility for Delegation Signer
	Author(s)	: S. Weiler
	Filename	: draft-weiler-dnsext-dnssec-2535-compat-00.txt
	Pages		: 0
	Date		: 2003-2-26

As the DNS Security (DNSSEC) specifications have evolved, the
syntax and semantics of the DNSSEC resource records have changed.
Many deployed nameservers understand variants of these semantics.
To avoid dangerous interactions when a resolver that understands an
earlier version of these semantics queries an authoritative server
that understands the new delegation signer semantics, this document
proposes changing the type codes and mnemonics of the previous
DNSSEC resource records (SIG, KEY, and NXT).

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-weiler-dnsext-dnssec-2535-compat-00.txt

To remove yourself from the IETF Announcement list, send a message to
ietf-announce-request with the word unsubscribe in the body of the message.

Internet-Drafts are also available by anonymous FTP. Login with the username
"anonymous" and a password of your e-mail address. After logging in,
type "cd internet-drafts" and then
	"get draft-weiler-dnsext-dnssec-2535-compat-00.txt".

A list of Internet-Drafts directories can be found in
http://www.ietf.org/shadow.html
or ftp://ftp.ietf.org/ietf/1shadow-sites.txt


Internet-Drafts can also be obtained by e-mail.

Send a message to:
	mailserv@ietf.org.
In the body type:
	"FILE /internet-drafts/draft-weiler-dnsext-dnssec-2535-compat-00.txt".

NOTE:	The mail server at ietf.org can return the document in
	MIME-encoded form by using the "mpack" utility.  To use this
	feature, insert the command "ENCODING mime" before the "FILE"
	command.  To decode the response(s), you will need "munpack" or
	a MIME-compliant mail reader.  Different MIME-compliant mail readers
	exhibit different behavior, especially when dealing with
	"multipart" MIME messages (i.e. documents which have been split
	up into multiple messages), so check your local documentation on
	how to manipulate these messages.


Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.


--
to unsubscribe send a message to namedroppers-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>