Subject: I-D Action:draft-ietf-dnsext-dnssec-rsasha256-05.txt

From: [email-masked]
Date: Tue, 29 Jul 2008 03:45:01 -0700 (PDT)

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the DNS Extensions Working Group of the IETF.

	Title           : Use of SHA-2 algorithms with RSA in DNSKEY and RRSIG Resource Records for DNSSEC
	Author(s)       : J. Jansen
	Filename        : draft-ietf-dnsext-dnssec-rsasha256-05.txt
	Pages           : 9
	Date            : 2008-07-29

This document describes how to produce RSA/SHA-256 and RSA/SHA-512
DNSKEY and RRSIG resource records for use in the Domain Name System
Security Extensions (DNSSEC, RFC 4033, RFC 4034, and RFC 4035).

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-dnsext-dnssec-rsasha256-05.txt

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.

---

From: Jelte Jansen <[email-masked]>
Date: Tue, 29 Jul 2008 12:58:07 +0200

> http://www.ietf.org/internet-drafts/draft-ietf-dnsext-dnssec-rsasha256-05.txt

As discussed here on namedroppers, I removed the section about how SHA1
signatures should be ignored, and only refer to RFC4035 section 2.2 as
protection against downgrade attacks, which should be enough.

I also removed the informational reference to NIST SP 800-57 part 3,
which unfortunately has not been released in time. Instead I just made
that reference to SP 800-57 in general.

Jelte

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: "Scott Rose" <[email-masked]>
Date: Tue, 29 Jul 2008 07:57:53 -0400

For those that care about references - NIST Special Pub 800-57 Part 3 only
has more specific recommendations about key management but refers to Part 1
for all general pointers like key lengths, hash algorithms to use for
specific security strengths, etc.

So 800-57 Part 1 has all the necessary information, just in a non-DNSSEC
specific format.

Scott

> -----Original Message-----
> From: [email-masked]
> [mailto:[email-masked]]On Behalf Of Jelte Jansen
> Sent: Tuesday, July 29, 2008 6:58 AM
> To: [email-masked]
> Subject: Re: I-D Action:draft-ietf-dnsext-dnssec-rsasha256-05.txt
>
>
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> > 	Title           : Use of SHA-2 algorithms with RSA in
> DNSKEY and RRSIG Resource Records for DNSSEC
> > 	Author(s)       : J. Jansen

Jelte