Subject: [dnsext] IANA Registry for DNSSEC Digest types?

From: Phillip Hallam-Baker <[email-masked]>
Date: Thu, 9 Sep 2010 13:55:03 -0400

RFC 4034 defines several IANA registries for DNSSEC. Including a registry
for "DNSSEC Digest Types"

A.2.  DNSSEC Digest Types

  A "Digest Type" field in the DS resource record types identifies the
  cryptographic digest algorithm used by the resource record.  The
  following table lists the currently defined digest algorithm types.

             VALUE   Algorithm                 STATUS
               0      Reserved                   -
               1      SHA-1                   MANDATORY
             2-255    Unassigned                 -

Key Assurance is going to need to have digest algorithm identifiers. I was
just writing up the IANA considerations section when I discovered that this
registry is not included in the Domain Name System Security (DNSSEC)
Algorithm Numbers registry as I expected.

This appears to me to be an oversight. It appears that this has happened
since DNSSEC does not actually make use of the digest independent of a
public key algorithm. I want to use SHA256 obviously.

So this leaves the following options:

1) Get the DNSSEC registry created and add in SHA256
2) Use ASN.1 OIDS instead.

I am thinking of a one pager which only has the following IANA instruction:

VALUE   Algorithm   Size       Reference
 0      Reserved                   -
 1      SHA-1       160        [RFC4034]
 2      SHA-2       256        [This]
 3      SHA-2       512        [This]
 4      Reserved for 256 bit SHA3 outcome
 5      Reserved for 512 bit SHA3 outcome
6-255    Unassigned                 -

[U.S. Department of Commerce, "Secure Hash Standard", FIPS PUB 180-3,
October 2008.]

The reserved values for SHA3 would take effect on the announcement of the
corresponding FIPS publication in the US Federal Register. Since this is an
international paper of record this is a reasonable approach in my view.

Incidentally those applying for the SHA-3 competition might note the
following requirement:

A.3 The algorithm must support 224, 256, 384, and 512-bit message
digests, and must support a maximum message length of at least 264 bits.

I think they meant 2^64, it makes a difference.

-- 
Website: http://hallambaker.com/

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Thu, 9 Sep 2010 14:12:19 -0400

Ah found it.

The registry name does not have DNS in it.

On Thu, Sep 9, 2010 at 2:05 PM, Rickard Bellgrim <[email-masked]>wrote:

> RFC4509 adds support for SHA256.
>
> // Rickard
>
> 9 sep 2010 kl. 19:55 skrev "Phillip Hallam-Baker" <[email-masked]>:
>
> Website: <http://hallambaker.com/>http://hallambaker.com/
>
>
> _______________________________________________
> keyassure mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/keyassure
>
>

---

From: Tony Finch <[email-masked]>
Date: Thu, 9 Sep 2010 19:26:55 +0100

On Thu, 9 Sep 2010, Phillip Hallam-Baker wrote:
>
> DNSSEC does not actually make use of the digest independent of a
> public key algorithm.

Yes it does, in DS records. The 4th octet of DS RDATA is the digest type,
which is independent of the DNSKEY algorithm in the 3rd octet.

Tony.
-- 
f.anthony.n.finch  <[email-masked]>  http://dotat.at/
HUMBER THAMES DOVER WIGHT PORTLAND: NORTH BACKING WEST OR NORTHWEST, 5 TO 7,
DECREASING 4 OR 5, OCCASIONALLY 6 LATER IN HUMBER AND THAMES. MODERATE OR
ROUGH. RAIN THEN FAIR. GOOD.