Re: NSEC version field (Re: NSEC2- and an Authenticated Denial Mechanism Flag)

[Paul Vixie <paul@vix.com>]

> ...  I am assuming that DNSSECbis is modified so NSEC RRs
> contain a version field, which is set to 1 (say).

please don't do this.  find a signalling method, such as a dnskey
algorythm id or some existing MBZ field, that will allow new negative
signatures in the future (such as the one we're calling NSEC2) but
that will not require the dnssec-bis docset to be recut yet again.

changes to the dnssec-bis docset at this stage should be because of
document or protocol quality issues, not because of design changes
in the protocol itself.

--
to unsubscribe send a message to namedroppers-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>