Subject: Re: DS design questions

From: Bill Manning <[email-masked]>
Date: Mon, 26 Aug 2002 10:32:13 -0700 (PDT)

a couple of questions came up last week in our testing of
	the recent bind snapshot (9.3.0s20020722).

    --  how breakable is the key? e.g.  ("They generated it with old package 
	X which has these seven known bugs.  Also it appears to have a 
	kleptographic Trojan Horse.")  Who has looked at the algorithm
	implementation for correctness?
    --  allowable key lengths.  there is a desire to use keys larger than
	the 1024 at some points in the DNS heirarchy.
    --  are there any other signing tools than those that come with the
	bind distribution?

--bill

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Bill Manning <[email-masked]>
Date: Mon, 26 Aug 2002 11:21:52 -0700 (PDT)

% On Mon, 26 Aug 2002, Bill Manning wrote:
% 
% >     --  allowable key lengths.  there is a desire to use keys larger than
% > 	the 1024 at some points in the DNS heirarchy.
% 
% RSA is defined for up to 4096 bits in RFC 3110.  I don't know of any 
% problems using the bind-provided key generation program / signing tools 
% with keys this large, except that performance is really bad (which is a 
% limitation of modern hardware).  The DSA algorithm is only defined to 1024 
% bits, so there's nothing DNSSEC can do.
% 

	Sigh...  DSA or RSA or both?
	didn't we have this discussion back in the day?
	can we mix DSA/RSA using DS with impunity?
	will the resolver beable to follow a validity chain?

	(he asks, hoping someone else has tested this first...)

-- 
--bill

---

From: Brian Wellington <[email-masked]>
Date: Mon, 26 Aug 2002 11:29:52 -0700 (PDT)

> 	Sigh...  DSA or RSA or both?

I don't think there's a limitation on the RSA algorithm; RFC 3110 limits 
DNSSEC to 4096 bits.

The DSA algorithm is limited to 1024 bits.

> 	didn't we have this discussion back in the day?

Which discussion?

> 	can we mix DSA/RSA using DS with impunity?

Yes.

> 	will the resolver beable to follow a validity chain?

Yes.

> 	(he asks, hoping someone else has tested this first...)

See the bind9 dnssec test suite, which uses RSA-MD5, DSA, and RSA-SHA1 in 
the same tree.

Brian

---

From: Jim Reid <[email-masked]>
Date: Mon, 26 Aug 2002 11:41:57 -0700

>>>>> "Brian" == Brian Wellington <[email-masked]> writes:

    >> -- are there any other signing tools than those that come with
    >> the bind distribution?

    Brian> I don't know of any other public tools.

What about the Perl stuff Olaf developed at RIPE NCC? I dunno if this
implements DS yet though.