Subject: TKEY query delete mode

From: [email-masked] (Randy Hall)
Date: Thu, 09 Nov 2000 16:01:04 -0500

Section 4.2 of RFC 2930 (TKEY protocol) describes a query 
to request the server delete a key.

It is unclear (to me) whether 

a) the server must respond to the query after deleting the 
key, and

b) if so, whether the response must be signed (presumably
using the deleted key, which seems like a bad idea).

The RFC does not appear to be explicit.  I assume the answer 
is NO to both questions.  Can anyone clarify this for me?

Thx in advance,
Randy

to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.

---

From: Brian Wellington <[email-masked]>
Date: Thu, 9 Nov 2000 21:43:50 -0800 (PST)

> a) the server must respond to the query after deleting the 

I would think so.  The text doesn't give any indication otherwise, and all
normal queries must be responded to.

> using the deleted key, which seems like a bad idea).

Again, the text doesn't indicate anything out of the ordinary.  If the
request is signed (which it must be, according to section 3), the response
must be signed with the same key (according to RFC 2845).  Nothing says
that it must be the same key as is being deleted, but I don't see anything
saying it can't.

For the record, bind 9 supports signing the response to a deletion with
the deleted key.  The key is no longer usable for any other purpose once
the deletion is processed, and the key is actually deleted after the
response is signed.

> is NO to both questions.  Can anyone clarify this for me?

I would assume the answers would both be YES, seeing no indication of the
contrary.

Brian