Subject: Re: 11.3. NSEC-to-NSEC3 transition Considerations

From: David Blacka <[email-masked]>
Date: Fri, 18 Aug 2006 16:31:26 -0400

Mark Andrews wrote:

>> If this case is defined as BOGUS, then yes, we will have to define new
>> signing algorithm aliases (or something) every time we add new hash
>> algorithms.
>>
>> Which would you prefer?
> 
> 	Actually I would prefer to only accept new hash algorithms
> 	with a corresponding change in dnskey algorithm identifiers.
> 	To migrate to new hash algorithm you perform a key rollover
> 	then you perform the hash algorithm change.  This preserves
> 	all the logic for identifing if a zone is secure or not.

Why is this logic important to preserve?  That is, if the cost is having
 to allocate new algorithm codes every time we introduce new hash
algorithms, what is the benefit?

-- 
David Blacka                      <[email-masked]>
Sr. Engineer    VeriSign Infrastructure Product Engineering

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: "Olaf M. Kolkman" <[email-masked]>
Date: Fri, 25 Aug 2006 18:08:54 +0200

> algorithms, what is the benefit?

Would it be likely that if a new hash algorithm is needed for NSEC3  
proofs it is also 'wise' to introduce a new hash for the signature  
algorithm?

Besides, is there a real cost associated with having to allocate a  
new code point? One needs to go through all the trouble of upgrading  
server infrastructure and pushing validator code around. (?)

--Olaf (namedropper)

-----------------------------------------------------------
Olaf M. Kolkman
NLnet Labs
http://www.nlnetlabs.nl/