Subject: Re: DNSSEC-RECORDS ISSUE: DSA from Mandatory to Optional

From: Donald Eastlake 3rd <[email-masked]>
Date: Wed, 24 Sep 2003 09:43:03 -0400 (EDT)

I'm in favor of the change.

Thanks,
Donald
======================================================================
 Donald E. Eastlake 3rd                       [email-masked]
 155 Beaver Street              +1-508-634-2066(h) +1-508-851-8280(w)
 Milford, MA 01757 USA                   [email-masked]

On Wed, 24 Sep 2003, Olaf M. Kolkman wrote:

> Date: Wed, 24 Sep 2003 13:16:31 +0200
> From: Olaf M. Kolkman <[email-masked]>
> To: [email-masked]
> Subject: DNSSEC-RECORDS ISSUE: DSA from Mandatory to Optional
> 
> 
> I want to point attention to draft-ietf-dnsext-dnssec-records-04 section 1.3.1
> 
> 1.3.1 Open Technical Issues
> 
>    The cryptographic algorithm types (Appendix A) requires input from
>    the working group.  The DSA algorithm was moved to OPTIONAL.  This
>    had strong consensus in workshops and various discussions and a
>    separate internet draft solely to move DSA from MANDATORY to OPTIONAL
>    seemed excessive.  This draft solicits input on that proposed change.
> 
> Please speak for or against this. 
> 
> Default action will be to accept DSA moved to OPTIONAL as working-group concensus. 
> 
> 
> Review of this I-D and the dnssec-intro document is appreciated. 
> 
> -- Olaf Kolkman
>    DNSEXT Co-Chair

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Jakob Schlyter <[email-masked]>
Date: Wed, 24 Sep 2003 16:33:00 +0200 (CEST)

> Default action will be to accept DSA moved to OPTIONAL as working-group

yes, I think we should move DSA to optional.

	jakob

---

From: Michael Richardson <[email-masked]>
Date: Wed, 24 Sep 2003 09:33:05 -0400

-----BEGIN PGP SIGNED MESSAGE-----

The words MANDATORY and OPTIONAL are confusing to me.

It says:
   A DNSSEC aware resolver or name server MUST implement all MANDATORY
   algorithms.

So, I know that MANDATORY is equivalent to 2119's MUST.
Is "OPTIONAL" equal to "SHOULD" or "MAY"

I feel uncomfortable with DSA as "MAY".
I would feel okay with DSA as "SHOULD".

If we had a documented third alternative, I might feel okay if it said
you MUST implement at least two algorithms. Of course, that wouldn't
guarantee that we could "failover" to the other algorithm, since there
wouldn't a unique choice of what to failover to.

You may want to look at draft-ietf-ipsec-ikev2-algorithms-04.txt for
how IPsec is handling this topic.

]      Out and about in Ottawa.    hmmm... beer.                |  firewalls  [
]   Michael Richardson, Sandelman Software Works, Ottawa, ON    |net architect[
] [email-masked] http://www.sandelman.ottawa.on.ca/ |device driver[
] panic("Just another Debian/notebook using, kernel hacking, security guy");  [