Re: [idn] SC/TC equivalence

[Erik Nordmark <Erik.Nordmark@eng.sun.com>]

> I think the server is always supposed to answer the query that was asked
> (A, not A').  If maintaining records for all equivalent variants of
> A' is too expensive, it could instead generate the response (and the
> signature) on the fly.  It could use caching to remember the responses
> for the most common variants.

DNSsec is specified to work without keeping the private key on-line
(doing the signing off-line can be made secure) thus you
can't assume that servers will be able to sign on the fly.

  Erik