Subject: [Tools-discuss] DNSSEC algorithm used on ietf.org

From: Petr Menšík <[email-masked]>
Date: Wed, 23 Mar 2022 12:28:39 +0100

Hello,

I work in Red Hat on DNS related products. We were analysing impact on
disabling algorithm RSASHA1. It is in a strange sitation, because IETF
itself deprecated this algorithm [1], but is using it for all documents
it publishes. For some reason site stats.dnssec-tools.org gives it as an
example [2]. It seems update of Key signing key (ksk) and algorithm
should be upgraded to more recent algorithm. There is also informational
RFC 7583 [3], which should help with it.

Is there already plan to upgrade DNSSEC algorithm? Is there any specific
reason why it stayed unchanged?

I were directed here by the support of ietf. Might be also interesting
topic for dnsop WG.

Were upgrade already considered?

Best Regards,
Petr Menšík

1. https://datatracker.ietf.org/doc/html/rfc8624#section-3
2. https://stats.dnssec-tools.org/explore/
3. https://datatracker.ietf.org/doc/html/rfc7583

-- 
Petr Menšík
Software Engineer
Red Hat, http://www.redhat.com/
email: [email-masked]
PGP: DFCF908DB7C87E8E529925BC4931CA5B6C9FC5CB

---

From: "Salz, Rich" <[email-masked]>
Date: Wed, 23 Mar 2022 12:35:02 +0000

Hi there.  I think you got a bad pointer :)  This list is for discussion of the tools that the IETF itself uses, notably the datatracker.ietf.org website.

I think starting with DNSOP might be more fruitful.

---

From: Petr Menšík <[email-masked]>
Date: Wed, 23 Mar 2022 15:26:37 +0100

Well, but that involves infrastructure used by IETF, which is modified
internally. I somehow doubt dnsop WG members has access to any
production systems of IETF. I would forward it there.

---

From: "Salz, Rich" <[email-masked]>
Date: Wed, 23 Mar 2022 14:30:40 +0000

I am sorry, I misunderstood your question.

You are saying that the DNS entries for ietf.org use an older key, and asking for if/when it will be updated.

---

From: Petr Menšík <[email-masked]>
Date: Wed, 23 Mar 2022 15:33:07 +0100

> You are saying that the DNS entries for ietf.org use an older key, and asking for if/when it will be updated.
Yes, my question was exactly about that. More precisely about change of
used algorithm (key type), change of just key would not be enough.

---

From: Michael Richardson <[email-masked]>
Date: Wed, 23 Mar 2022 17:30:24 +0100

Petr Menšík <[email-masked]> wrote:
    > it publishes. For some reason site stats.dnssec-tools.org gives it as
    > an example [2]. It seems update of Key signing key (ksk) and algorithm
    > should be upgraded to more recent algorithm. There is also
    > informational RFC 7583 [3], which should help with it.

I think you are saying that ietf.org itself is secured by RSASHA1.
see: https://dnsviz.net/d/ietf.org/dnssec/

While Rich's comment thta tools-discuss@   might be the wrong place for this,
dnsop WG is also not the right place.

I would email [email-masked].
This is something for AMSL (Glen) to consider how/when to replace the KSK and
ZSK with a newer algorithm. (My zones still use RSASHA1 too)

-- 
]               Never tell me the odds!                 | ipv6 mesh networks [ 
]   Michael Richardson, Sandelman Software Works        | network architect  [ 
]     [email-masked]  http://www.sandelman.ca/        |   ruby on rails    [

---

From: Petr Menšík <[email-masked]>
Date: Wed, 23 Mar 2022 20:52:00 +0100

That is where I started with ticket [rt5.ietf.org #4814] and Glen
suggested this list might be the best try. Here I am.

> ZSK with a newer algorithm. (My zones still use RSASHA1 too)
Well, then I think you may plan to upgrade your KSK algorithm also.