rthalley/dnspython — pull request #26 by mmmucky (2013-03-27 21:19:33+00:00)
Title:  Remove DNSKEY keytag uniqueness assumption (RFC 4034, section 8)

Hi,

Here is a patch to care of a situation where two DNSKEYs in a zone share the same keytag, which could cause false validation failures.

RFC 4043: Section 8, Paragraph 3

The key tag is used to help select DNSKEY resource records efficiently, but it does not uniquely identify a single DNSKEY resource record. It is possible for two distinct DNSKEY RRs to have the same owner name, the same algorithm type, and the same key tag. An implementation that uses only the key tag to select a DNSKEY RR might select the wrong public key in some circumstances. Please see Appendix B for further details.

Cheers,
James Dempsey