Subject: [DNSOP] Fwd: New Version Notification for draft-muks-dnsop-dnssec-sha3-01

From: Mukund Sivaraman <[email-masked]>
Date: Mon, 10 Apr 2017 15:08:47 +0530

Hi all

> A new version of I-D, draft-muks-dnsop-dnssec-sha3-01.txt
> has been successfully submitted by Mukund Sivaraman and posted to the
> IETF repository.
>
> Name:		draft-muks-dnsop-dnssec-sha3
> Revision:	01
> Title:		Use of SHA-3 (Keccak) and RSASSA-PSS in DNSSEC
> Document date:	2017-04-08
> Group:		Individual Submission
> Pages:		26
> URL:            https://www.ietf.org/internet-drafts/draft-muks-dnsop-dnssec-sha3-01.txt
> Status:         https://datatracker.ietf.org/doc/draft-muks-dnsop-dnssec-sha3/
> Htmlized:       https://tools.ietf.org/html/draft-muks-dnsop-dnssec-sha3-01
> Htmlized:       https://datatracker.ietf.org/doc/html/draft-muks-dnsop-dnssec-sha3-01
> Diff:           https://www.ietf.org/rfcdiff?url2=draft-muks-dnsop-dnssec-sha3-01
>
> Abstract:
>    This document specifies the use of SHA-3 (Keccak) hash functions in
>    DNSSEC.  It also specifies the use of the RSASSA-PSS signature scheme
>    for RSA keys.

A new revision of the draft has been uploaded:

- It now uses the RSASSA-PSS signature scheme (based on comments from
  Paul Hoffman & Francis) and adds RSASSA-PSS/SHA3-256,
  RSASSA-PSS/SHA3-384 and RSASSA-PSS/SHA3-512 for using SHA-3.

- It adds algorithms for RSASSA-PSS/SHA2-256 and RSASSA-PSS/SHA2-512 to
  use the SHA-2 algorithms with RSASSA-PSS.

- It adds algorithms for ECDSA/SHA3-256 and ECDSA/SHA3-384.

- It now has a better problem statement in the introduction (based on
  contents of reply from Paul Hoffman)

- BIND implementation has been updated here:
  https://github.com/muks/bind9/tree/sha3

- An independently written ldns implementation is here:
  https://github.com/tjeb/ldns

		Mukund

---

From: Bob Harold <[email-masked]>
Date: Mon, 10 Apr 2017 10:44:51 -0400

>   https://github.com/tjeb/ldns

Looking at the diff
https://www.ietf.org/rfcdiff?url2=draft-muks-dnsop-dnssec-sha3-01
is difficult because some of the DNSSEC example lines are not wrapped.
I don't know if that can be fixed.

-- 
Bob Harold

---

From: Mukund Sivaraman <[email-masked]>
Date: Mon, 10 Apr 2017 20:39:18 +0530

Hi Bob

> I don't know if that can be fixed.

We kind of restarted the draft adopting RSASSA-PSS, so please can you
review it this time from scratch without looking at the diff?

Many of the examples will need updating once algorithm numbers are
assigned for them (as for some calculations, the algorithm number is an
input), so we didn't spend time on wrapping the long lines in this
revision.

		Mukund