Evaluation: draft-ietf-dnsext-delegation-signer - Delegation Signer Resource Record

[IESG Secretary <iesg-secretary@ietf.org>]

Last Call to expire on: 2003-07-24

        Please return the full line with your position.

                      Yes  No-Objection  Discuss  Abstain
Harald Alvestrand    [   ]     [   ]     [   ]     [   ]
Steve Bellovin       [   ]     [   ]     [   ]     [   ]
Scott Bradner        [   ]     [   ]     [   ]     [   ]
Randy Bush           [   ]     [   ]     [   ]     [   ]
Patrik Faltstrom     [   ]     [   ]     [   ]     [   ]
Bill Fenner          [   ]     [   ]     [   ]     [   ]
Ned Freed            [   ]     [   ]     [   ]     [   ]
Ted Hardie           [   ]     [   ]     [   ]     [   ]
Russ Housley         [   ]     [   ]     [   ]     [   ]
Allison Mankin       [   ]     [   ]     [   ]     [   ]
Thomas Narten        [ X ]     [   ]     [   ]     [   ]
Erik Nordmark        [   ]     [   ]     [   ]     [   ]
Jon Peterson         [   ]     [   ]     [   ]     [   ]
Jeff Schiller        [   ]     [   ]     [   ]     [   ]
Margaret Wasserman   [   ]     [   ]     [   ]     [   ]
Bert Wijnen          [   ]     [   ]     [   ]     [   ]
Alex Zinin           [   ]     [   ]     [   ]     [   ]

2/3 (9) Yes or No-Objection opinions needed to pass.

DISCUSSES AND COMMENTS:
======================



^L 
---- following is a DRAFT of message to be sent AFTER approval ---
From: The IESG <iesg-secretary@ietf.org>
To: IETF-Announce:;
Cc: Internet Architecture Board <iab@iab.org>,
    RFC Editor <rfc-editor@rfc-editor.org>, <namedroppers@ops.ietf.org>
Subject: Protocol Action: 'Delegation Signer Resource Record' to 
         Proposed Standard 

The IESG has approved the Internet-Draft 'Delegation Signer Resource 
Record' <draft-ietf-dnsext-delegation-signer-15.txt> as a Proposed 
Standard. This document is the product of the DNS Extensions Working Group. 
The IESG contact persons are Thomas Narten and Margaret Wasserman.

Technical Summary
 
This document defines the Delegation Signer resource record (RR),
which replaces the DNSSEC KEY record chain of trust defined in the
original RFC 2535 DNSSEC protocol. The DS RR resides only at the
parent and identifies (and signs) the key(s) that the child uses to
self-sign its own KEY RRset. In contrast, the previously-used method,
which relied on a DNSSEC KEY record chain of trust, had a number of
operational issues, including that the same data was located in
different places within the DNS (parent and child), which led to
inconsistencies in practice, difficulties in updating signatures in
some cases, and complexity in resolvers. The DS RR is an explicit
statement about the delegation, rather than relying on inference.

Delegation Signer changes the semantics of some previously defined
DNSSEC operations and is not backwards compatible with RFC 2535.
 
Working Group Summary
 
There was consensus in the WG for this document.

Protocol Quality
 
This document has been reviewed for the IESG by Thomas Narten and Erik
Nordmark.