<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><div>On Nov 27, 2013, at 4:46, Peter Palfrader wrote:</div><blockquote type="cite"><div><br></div><div>Are there any guesstimates or even hard data what percentage of<br>resolvers, if any, will consider zones bogus if the algorithm rollover<br>is handled in the more liberal style as a regular double-signature KSK<br>rollover?<br></div></blockquote></div><div><br></div>This is a good question, one that I am dealing with myself.<div><br></div><div>Ironically, in private email yesterday I sent this to someone who was involved when the rules that have caused the problem were written. In the sense "the horse has left the barn already, but:"</div><div><br></div><div><div>From the end of section 2.2 in RFC 4035:</div><div><br></div><div><pre style="color: rgb(0, 0, 0); font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-align: start; text-indent: 0px; text-transform: none; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; white-space: pre-wrap; ">There MUST be an RRSIG for each RRset using at least one DNSKEY of
each algorithm in the zone apex DNSKEY RRset. The apex DNSKEY RRset
itself MUST be signed by each algorithm appearing in the DS RRset
located at the delegating parent (if any).</pre><div><div>It should be:</div></div></div><div><br></div><div><div><pre style="color: rgb(0, 0, 0); font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-align: start; text-indent: 0px; text-transform: none; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; white-space: pre-wrap; ">There MUST be an RRSIG for each RRset using at least one DNSKEY of
each algorithm in the zone apex DNSKEY RRset that is also in the DS RRset. The apex DNSKEY RRset
itself MUST be signed by each algorithm appearing in the DS RRset
located at the delegating parent (if any).</pre></div></div><div>The latter is what I thought had been written until I re-read the section a few weeks ago.</div><div><br></div><div>It's too late to go back and change implementations that interpreted even the as-is text incorrectly. By "wrong" I mean interpretations of the rule that were not in line with the apparently incompletely stated intent of the rule writers. In the rear view mirror I can see how a validator might take the above as a requirement, but it means that they didn't notice that section 2 was "zone signing" and 2.2 was in "including RRSIGs in a zone" and not in sections 4 or 5 (resolving and validating).</div><div><br></div><div>The same argument has been made about the confusion over the definition of a "domain name" in STD 13 and "host name" in RFC 1123. Context matters.</div><div><br></div><div>So - I wish we could measure the impact of what has been deployed.</div><div><br></div><div>
<span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; "><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; "><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=<span></span>-=-=-=-<span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; "><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><div>Edward Lewis <span></span> <br>NeuStar <span></span> You can leave a voice message at +1-571-434-5468<br><br>Why is it that people who fear government monitoring of social media are</div><div>surprised to learn that I avoid contributing to social media?</div></div></div></span></div></span></span>
</div>
<br></div></body></html>