Subject: Re: [DNSOP] New Version Notification for draft-pusateri-dnsop-update-timeout-00.txt

From: Mark Andrews <[email-masked]>
Date: Tue, 4 Sep 2018 10:58:33 +1000

6.  Cryptographic Hash Requirements

   The cryptographic hash algorithm used SHOULD provide the following
   properties:

   1.  Well known algorithm with implementations easily available.

   2.  Trusted algorithm with resistance to collision attacks.

   3.  Minimize output length for efficient storage in the TIMEOUT
       resource record.

   While computational complexity is always a consideration when
   selecting algorithms, the frequency of this calculation is intended
   to be low volume and, therefore, this property is of reduced
   importance.

SHAKE128 does not meet these requirements.  In OPENSSL it is only
available in pre-release code.  It will be years before OPENSSL-1.1.1
is the OPENSSL release for most operating systems.

We (ISC) haven’t started working out what OPENSSL-1.1.1 breaks yet.
OPENSSL-1.1.0 broke lots of existing code.  Lots of code required
re-writing to work with OPENSSL-1.1.0 as it broke backwards compatibility
with OPENSSL-1.0.x.

Please pick hash algorithms that are already USED by DNS.  The results
can be truncated if you are worried about space.

And no it isn’t as easy as just calling OPENSSL.  PKCS#11 providers
also need to support the hash algorithm.
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742              INTERNET: [email-masked]

---

From: Tom Pusateri <[email-masked]>
Date: Tue, 4 Sep 2018 08:45:45 -0400

> On Sep 3, 2018, at 8:58 PM, Mark Andrews <[email-masked]> wrote:
> 

While I understand your point, OpenSSL 1.1.1 is the first release that will contain TLS 1.3. It is binary backward compatible with 1.1.0. Aside from our trivial use of SHAKE128, everyone is going to be upgrading to 1.1.1 as soon as possible to get TLS 1.3 support. See

https://wiki.openssl.org/index.php/TLS1.3

> also need to support the hash algorithm.

Ok, thanks for this extra info. I will look into it.

Tom