Subject: New IANA considerations for Typecode-rollover-05

From: Ólafur Gudmundsson/DNSEXT co-chair <[email-masked]>
Date: Thu, 06 Nov 2003 15:07:40 -0500

This proposed text replaces what is in the tcr-05.
Summary:
The main problem is to keep DNSEKY and KEY algorithm numbers in
sync, and possibly allow the definition DNS wire format for algorithms
that are not used by DNS, (for example ECC).
Solution is to create a separate DNS Security algorithm registry that
is not type dependant, then create one registry for each type that
stores KEY information that inherits definitions. This allows central
definition of DNS wireformat for public keys and then allow the
application specific type records (KEY, DNSKEY, IPSECKEY etc.) to
pick the algorithms they need.

Please send in corrections/suggestions to make this text better

	Olafur
---------
5. 0 IANA Considerations

This document updates the IANA registry for DNS Resource Record Types by
assigning types 46, 47 and 48 to the RRSIG, NSEC, and DNSKEY RRs, 
respectively.

This document updates the IANA registry for DNS Resource Record Types by
assigning types 46, 47 and 48 to the RRSIG, NSEC, and DNSKEY RRs, 
respectively.

Type 30 NXT is marked as obsolete.

Types 24 and 26 (SIG and KEY) are retained for SIG(0) [RFC2931] and TKEY
[RFC2930] use only.

For use representing Public Key's in DNS the DNS Security Algorithm Registry
is changed from being type KEY specific to a RR type independent, there
is no change in the current contents of the registry. Updating this
Registry requires IETF Standards Action.
When a RR type inherits a definition from this registry, it uses the
same one byte value to identify the algorithm as in this registry, unless
specified otherwise for that type.
Initial contents of this registry is:
      0    Reserved 
[RFC-ietf-dnsext-dnssec-2535typecode-change-04.txt]
      1    RSA/MD5                            [RFC2537]
      2    Diffie-Hellman                     [RFC2539]
      3    DSA/SHA1                           [RFC2536]
      4    Unassigned (IETF Standards action required)
      5    RSA/SHA-1                          [RFC3110]
  6-252    Unassigned (IETF Standards action required)
    253    Private algorithms - domain name   [RFC2535]
    254    Private algorithms - OID           [RFC2535]
    255    Reserved 
[RFC-ietf-dnsext-dnssec-2535typecode-change-04.txt]

For type KEY open a new registry named "KEY Algorithm registry" that 
inherits the following
the definitions currently in DNSSEC Security Algorithm Registry, with the 
same algorithm
number and mnemonics. Specifying a new Algorithm from the DNS Security 
Algorithm Registry requires IETF Consensus and a definition of a signature 
format for SIG RR type.
Initial contents of this registry is:
      1    RSA/MD5                            [RFC2537]
      2    Diffie-Hellman                     [RFC2539]
      3    DSA/SHA1                           [RFC2536]
      4    Unassigned (IETF Standards action required)
      5    RSA/SHA-1                          [RFC3110]
  6-252    Unassigned (IETF Standards action required)
    253    Private algorithms - domain name   [RFC2535]
    254    Private algorithms - OID           [RFC2535]
    255    Reserved 
[RFC-ietf-dnsext-dnssec-2535typecode-change-04.txt]

For type DNSKEY open a new registry named "DNSKEY algorithm registry"
that inherits following definitions from DNS Security Algorithm Registry:
      3    DSA/SHA1                           [RFC2536]
      5    RSA/SHA-1                          [RFC3110]
    253    Private algorithms - domain name   [RFC2535]
    254    Private algorithms - OID           [RFC2535]

RRSIG and DS Records use these values in their Algorithm value.
Other values from the DNS Security Algorithm Numbers registry are
available for assignment and require IETF Standards Action and a definition of
a RRSIG signature format.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>