Subject: [dnsext] I-D Action: draft-ietf-dnsext-dnssec-algo-signal-03.txt

From: [email-masked]
Date: Tue, 03 Jan 2012 12:22:28 -0800

A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the DNS Extensions Working Group of the IETF.

	Title           : Signaling Cryptographic Algorithm Understanding in DNSSEC
	Author(s)       : Steve Crocker
                          Scott Rose
	Filename        : draft-ietf-dnsext-dnssec-algo-signal-03.txt
	Pages           : 8
	Date            : 2012-01-03

   The DNS Security Extensions (DNSSEC) were developed to provide origin
   authentication and integrity protection for DNS data by using digital
   signatures.  These digital signatures can be generated using
   different algorithms.  This draft sets out to specify a way for
   validating end-system resolvers to signal to a server which
   cryptographic algorithms they support.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-dnsext-dnssec-algo-signal-03.txt

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

This Internet-Draft can be retrieved at:
ftp://ftp.ietf.org/internet-drafts/draft-ietf-dnsext-dnssec-algo-signal-03.txt

_______________________________________________
dnsext mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dnsext

---

From: Scott Rose <[email-masked]>
Date: Tue, 3 Jan 2012 15:35:13 -0500

This is basically a keep alive version, although there is one major change.  The option for listing the DS hashes has been removed since it doesn't add much.  If people think it is necessary it can be made a second EDNS option with a new code (both can be in the draft).

Scott

---

From: Miek Gieben <[email-masked]>
Date: Wed, 4 Jan 2012 08:56:43 +0100

[ Quoting <[email-masked]> at 15:35 on Jan  3 in "Re: [dnsext] I-D Act..." ]
> This is basically a keep alive version, although there is one major change.
>
> The option for listing the DS hashes has been removed since it doesn't add
> much.  If people think it is necessary it can be made a second EDNS option
> with a new code (both can be in the draft).

I think that is OK. 

But something else that pops up: how about signaling new hash algorithms
for nsec3 records? Right now, rolling the hash algorithm in nsec3 is next
to impossible (prolly the only way to do it is rolling the algorithms codes
again).

It that something to add to the draft?

 grtz,

-- 
    Miek