Subject: Re: [dnsext] Updated: Cryptographic Algorithm Identifier Allocation for DNSSEC

From: "Rose, Scott W." <[email-masked]>
Date: Thu, 17 Sep 2009 19:29:41 -0400

I haven't been following the list like I used to, so I don't know if this
has been fully addressed.

I think this draft warrants becoming a WG item.  With all the talk of new
algorithms coming up quickly this idea deserves consideration.  I volunteer
to review it.  

Scott

On 8/27/09 12:58 PM, "Paul Hoffman" <[email-masked]> wrote:

> I have updated the draft to include clarifications from the recent thread. The
> new version is at:
> 
> http://www.ietf.org/internet-drafts/draft-hoffman-dnssec-alg-allocation-01.txt
> 
> The added text is:
> 
> 3.  Expectations For Implementations
> 
>    It is important to note that, according to RFC 4034, DNSSEC
>    implementations are not expected to include all of the algorithms
>    listed in the IANA registry; in fact, RFC 4034 and the IANA registry
>    list an algorithm that implementations should not include.  This
>    document does nothing to change the expectation that there will be
>    items listed in the IANA registry that need not be (and in some
>    cases, should not be) included in all implementations.
> 
>    There are many reasons why a DNSSEC implementation might not include
>    one or more of the algorithms listed, even those on Standards Track.
>    In order to be compliant with the RFC 4034, an implementation only
>    needs to implement the algorithms listed as mandatory to implement in
>    the that standard, or updates to that standard.  This document does
>    nothing to change the list of mandatory to implement algorithms in
>    RFC 4034.
> 

I agree that this should be included.  Just to reinforce that any new
algorithm codes assigned using this process would be OPTIONAL from the start
unless also set to MANDATORY via a standards track doc.

Scott

> I hope this helps allay fears and repeat what is already in RFC 4034 that
> remains unchanged. I also hope it helps gain interest in this becoming a WG
> document.
> 
> --Paul Hoffman, Director
> --VPN Consortium
> 
> 

===================================
Scott Rose
NIST
[email-masked]
ph: +1 301-975-8439
http://www-x.antd.nist.gov/dnssec
http://www.dnsops.gov/
===================================

---

From: Paul Wouters <[email-masked]>
Date: Thu, 17 Sep 2009 20:58:14 -0400 (EDT)

On Thu, 17 Sep 2009, Paul Hoffman wrote:

>> Looks good to me. One minor point I was thinking about. Since we briefly saw a
>> proposal that would suggest a crypto preference based on the order/number of the
>> algorithm, and saw that most people did not like that implication, perhaps we
>> can explicitely state that the order of algorithms in the registry does not
>> signify or imply cryptographic strength or preference.
>>
>> Paul
>
> Does "looks good to me" mean that you support this as a WG work item? 
> If so, please say this on the list.

Yes.

Paul