Subject: Re: DS Algorithm selection and SHA1 deprecation

From: Wes Hardaker <[email-masked]>
Date: Tue, 06 Dec 2005 21:54:06 -0800

>>>>> On Wed, 07 Dec 2005 15:59:22 +1100, Mark Andrews <[email-masked]> said:

>> Because zone administrators can not control the deployment support
>> of SHA-256 in deployed validators that may referencing any given
>> zone, deployments should consider publishing both SHA-1 and SHA-256
>> based DS records for a while.  If multiple algorithms are used for a
>> given name then both SHA-1 and SHA-256 based DS records should be
>> published for every algorithm.  Whether to make use of both digest
>> types and for how long is a policy decision that extends beyond the
>> scope of this document.

Mark> I'd still prefer the following change

Mark> s/algorithm/algorithm and preferably for every DNSKEY for which a DS is being generated/
	
Ok, but that's actually sort of stating the same thing again.  Can't
we simplify things and just use your last wording without mentioning
algorithms?

  Because zone administrators can not control the deployment support of
  SHA-256 in deployed validators that may referencing any given zone,
  deployments should consider publishing both SHA-1 and SHA-256 based DS
  records.  This should be done for every DNSKEY for which a DS records
  are being generated.  Whether to make use of both digest types and for
  how long is a policy decision that extends beyond the scope of this
  document.

-- 
Wes Hardaker
Sparta, Inc.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Mark Andrews <[email-masked]>
Date: Wed, 07 Dec 2005 18:50:12 +1100

>   how long is a policy decision that extends beyond the scope of this

	I'm fine with this wording.

--
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

---

From: Andrew Sullivan <[email-masked]>
Date: Wed, 7 Dec 2005 07:25:54 -0500

>   records.  This should be done for every DNSKEY for which a DS records

I like this wording.  It gives useful operational guidance without
setting policy.

A

-- 
----
Andrew Sullivan                         204-4141 Yonge Street
Afilias Canada                        Toronto, Ontario Canada
<[email-masked]>                              M2P 2A8
                                        +1 416 646 3304 x4110