Subject: [dnsext] I-D Action: draft-ietf-dnsext-dnssec-algo-imp-status-00.txt

From: [email-masked]
Date: Mon, 30 Jan 2012 10:03:38 -0800

A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the DNS Extensions Working Group of the IETF.

	Title           : Applicability Statement: DNS Security (DNSSEC) DNSKEY Algorithm Implementation Status
	Author(s)       : Scott Rose
	Filename        : draft-ietf-dnsext-dnssec-algo-imp-status-00.txt
	Pages           : 6
	Date            : 2012-01-30

   The DNS Security Extensions (DNSSEC) requires the use of
   cryptographic algorithm suites for generating digital signatures over
   DNS data.  There is currently an IANA registry for these algorithms
   that is incomplete in that it lacks the recommended implementation
   status of each algorithm.  This document provides an applicability
   statement on algorithm implementation compliance status for DNSSEC
   implementations.  This document lists each algorithm's status based
   on the current reference.  In the case that an algorithm is specified
   without an implementation status, this document assigns one.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-dnsext-dnssec-algo-imp-status-00.txt

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

This Internet-Draft can be retrieved at:
ftp://ftp.ietf.org/internet-drafts/draft-ietf-dnsext-dnssec-algo-imp-status-00.txt

_______________________________________________
dnsext mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dnsext

---

From: Edward Lewis <[email-masked]>
Date: Mon, 30 Jan 2012 15:31:40 -0500

Stupid question...

Why do we have

"DSA-NSEC3-SHA1" and "RSASHA1-NSEC3-SHA1"

and not

"DSA-NSEC3" and "RSASHA1-NSEC3"?

Is that just they way it was defined in RFC 5155?  Or is it from 
somewhere else?

I.e., why the extra "-SHA1"?

I suppose the ship has sailed on changing that though ... if it were 
changeable.

-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis             
NeuStar                    You can leave a voice message at +1-571-434-5468

2012...time to reuse those 1984 calendars!

---

From: Paul Hoffman <[email-masked]>
Date: Mon, 30 Jan 2012 13:48:14 -0800

On Jan 30, 2012, at 12:31 PM, Edward Lewis wrote:

> Is that just they way it was defined in RFC 5155?  Or is it from somewhere else?
> 

In the future, there might be different hash algorithms to use with NSEC3, yes?

--Paul Hoffman

---

From: Scott Rose <[email-masked]>
Date: Tue, 31 Jan 2012 10:11:17 -0500

That's the mnemonics used in RFC 5155 and I didn't want to change it, so it's there for consistency.

Scott

---

From: Edward Lewis <[email-masked]>
Date: Tue, 31 Jan 2012 12:46:50 -0500

>In the future, there might be different hash algorithms to use with 

Not really.  We only needed an NSEC3-ized RSA/SHA-1 to deal with 
backward compatibility issues at the time.  From here out, any "new" 
DNSSEC "algorithm" will be defined for NSEC3 and NSEC.

And - for RSASHA1-NSEC3-SHA1, the -SHA1 is there twice!
-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis
NeuStar                    You can leave a voice message at +1-571-434-5468

---

From: Edward Lewis <[email-masked]>
Date: Tue, 31 Jan 2012 14:58:27 -0500

>it's there for consistency.

I can buy that.  (But given that inconsistency in the docs has been a 
"family tradition"... ;))

Seriously I don't think that we can change the names.  Still, I'm 
left scratching my head over this.
-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis
NeuStar                    You can leave a voice message at +1-571-434-5468