Subject: Re: DS design questions

From: Bill Manning <[email-masked]>
Date: Mon, 26 Aug 2002 11:37:20 -0700 (PDT)

% > 	didn't we have this discussion back in the day?
% 
% Which discussion?
% 
% > 	can we mix DSA/RSA using DS with impunity?
% 
% Yes.
% 
% > 	will the resolver beable to follow a validity chain?
% 
% Yes.
% 
% > 	(he asks, hoping someone else has tested this first...)
% 
% See the bind9 dnssec test suite, which uses RSA-MD5, DSA, and RSA-SHA1 in 
% the same tree.
% 
% Brian

	will look.  I remember having problems with a child using RSA
	and the parent using DSA but that was so long ago...

-- 
--bill

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Johan Ihren <[email-masked]>
Date: 27 Aug 2002 21:05:57 +0200

Brian Wellington <[email-masked]> writes:

> > % bits, so there's nothing DNSSEC can do.
> > 
> > 	Sigh...  DSA or RSA or both?
> 
> I don't think there's a limitation on the RSA algorithm; RFC 3110 limits 
> DNSSEC to 4096 bits.
> 
> The DSA algorithm is limited to 1024 bits.
> 
> > 	didn't we have this discussion back in the day?
> 
> Which discussion?

San Diego, December 2000... ;-)

Johan