Subject: [DNSOP] Last Call: <draft-ietf-dnsop-algorithm-update-05.txt> (Algorithm Implementation Requirements and Usage Guidance for DNSSEC) to Proposed Standard

From: The IESG <[email-masked]>
Date: Wed, 13 Feb 2019 11:29:30 -0800

The IESG has received a request from the Domain Name System Operations WG
(dnsop) to consider the following document: - 'Algorithm Implementation
Requirements and Usage Guidance for DNSSEC'
  <draft-ietf-dnsop-algorithm-update-05.txt> as Proposed Standard

The IESG plans to make a decision in the next few weeks, and solicits final
comments on this action. Please send substantive comments to the
[email-masked] mailing lists by 2019-02-27. Exceptionally, comments may be
sent to [email-masked] instead. In either case, please retain the beginning of
the Subject line to allow automated sorting.

Abstract

   The DNSSEC protocol makes use of various cryptographic algorithms in
   order to provide authentication of DNS data and proof of non-
   existence.  To ensure interoperability between DNS resolvers and DNS
   authoritative servers, it is necessary to specify a set of algorithm
   implementation requirements and usage guidelines to ensure that there
   is at least one algorithm that all implementations support.  This
   document defines the current algorithm implementation requirements
   and usage guidance for DNSSEC.  This document obsoletes [RFC6944].

The file can be obtained via
https://datatracker.ietf.org/doc/draft-ietf-dnsop-algorithm-update/

IESG discussion can be tracked via
https://datatracker.ietf.org/doc/draft-ietf-dnsop-algorithm-update/ballot/

No IPR declarations have been submitted directly on this I-D.

---

From: Mats Dufberg <[email-masked]>
Date: Fri, 15 Feb 2019 16:20:26 +0000

The table in section 3.3 ("DS and CDS Algorithms") of the draft states that SHA-1 is "MUST NOT" for "DNSSEC Delegation" but in the narrative text under the table it states "SHA-1 [...] is NOT RECOMMENDED for use in generating new DS and CDS records."

The two statements should be consistent in the final RFC.

Yours,
Mats

---
Mats Dufberg
DNS Specialist, IIS
Mobile: +46 73 065 3899
https://www.iis.se/en/

-----Original Message-----
From: DNSOP <[email-masked]> on behalf of The IESG <[email-masked]>
Reply-To: "[email-masked]" <[email-masked]>
Date: Wednesday, 13 February 2019 at 20:30
To: IETF-Announce <[email-masked]>
Cc: Tim Wicinski <[email-masked]>, "[email-masked]" <[email-masked]>, "[email-masked]" <[email-masked]>, "[email-masked]" <[email-masked]>
Subject: [DNSOP] Last Call: <draft-ietf-dnsop-algorithm-update-05.txt> (Algorithm Implementation Requirements and Usage Guidance for DNSSEC) to Proposed Standard

    
    Abstract

    

    
    
    _______________________________________________
    DNSOP mailing list
    [email-masked]
    https://www.ietf.org/mailman/listinfo/dnsop

---

From: Paul Wouters <[email-masked]>
Date: Sun, 17 Feb 2019 19:13:01 -0500 (EST)

> The two statements should be consistent in the final RFC.

Done, thanks for spotting that.

https://tools.ietf.org/rfcdiff?url2=draft-ietf-dnsop-algorithm-update-06.txt

     SHA-1 is still in wide use for DS records, so validators MUST
-   implement validation, but it is NOT RECOMMENDED for use in generating
-   new DS and CDS records.  (See Operational Considerations for caveats
-   when upgrading from SHA-1 to SHA-256 DS Algorithm.)
+   implement validation, but it MUST NOT be used to generate new DS and
+   CDS records.  (See Operational Considerations for caveats when
+   upgrading from SHA-1 to SHA-256 DS Algorithm.)

Paul

---

From: Mats Dufberg <[email-masked]>
Date: Mon, 18 Feb 2019 17:05:29 +0000

If this draft is approved, the new RFC will obsolete RFC 6944. RFC 6944, in turn, updates eight other RFCs. As I interpret it, the new RFC will inherit that role. I think that should be explicitly stated in the new RFC.

Yours,
Mats

---
Mats Dufberg
DNS Specialist, IIS
Mobile: +46 73 065 3899
https://www.iis.se/en/

-----Original Message-----
From: DNSOP <[email-masked]> on behalf of The IESG <[email-masked]>
Reply-To: "[email-masked]" <[email-masked]>
Date: Wednesday, 13 February 2019 at 20:30
To: IETF-Announce <[email-masked]>
Cc: Tim Wicinski <[email-masked]>, "[email-masked]" <[email-masked]>, "[email-masked]" <[email-masked]>, "[email-masked]" <[email-masked]>
Subject: [DNSOP] Last Call: <draft-ietf-dnsop-algorithm-update-05.txt> (Algorithm Implementation Requirements and Usage Guidance for DNSSEC) to Proposed Standard

    
    Abstract

---

From: "Peter van Dijk" <[email-masked]>
Date: Thu, 28 Feb 2019 16:13:15 +0100

> the Subject line to allow automated sorting.

As this pertains to a section that will apparently be removed for 
publication, only posting it here on dnsop@ for historical reasons:

PowerDNS has removed all GOST support as of version 4.2, which is due to 
be released any day now, so please change that cell in section 6.1 to N.

Kind regards,
-- 
Peter van Dijk
PowerDNS.COM BV - https://www.powerdns.com/