Subject: [DNSOP] draft-hoffman-dnssec-iana-cons

From: Vladimír Čunát <[email-masked]>
Date: Tue, 17 Nov 2020 09:09:58 +0100

Hello.

I didn't speak but I'd still like to indicate my support.  Requiring
"Standards Action" just to allocate algorithm numbers seems quite an
overkill.  I'd find it healthy to split that into an easier step, so
it's also clearly separable from endorsing or even requiring support for
those algorithms (documents like RFC 8624).

Behavior with unsupported algorithms isn't ideal but it's specified and
seems OK to me.  People signing with less supported algorithms will
naturally be put at a disadvantage, but they do know the tradeoff
beforehand.  And... without allocated numbers you don't really want to
deploy the algorithm in validators, so it's a bit chicken-egg situation.

--Vladimir | Knot Resolver dev.

---

From: Tony Finch <[email-masked]>
Date: Tue, 17 Nov 2020 21:21:43 +0000

Seems like a good idea to make this more consistent.

A correction for the first paragraph: change

   DNSSEC is primarily described in [RFC4033], [RFC4034], and [RFC4035].
   DNSSEC commonly uses two resource records beyond those defined in RFC
   4034: DS [RFC3658] and NSEC3 [RFC5155].

to

   DNSSEC is primarily described in [RFC4033], [RFC4034], and [RFC4035].
   DNSSEC commonly uses two resource records beyond those defined in RFC
   4034: NSEC3 and NSEC3PARAM [RFC5155].

DS is specified in RFC 4034. I suppose it's OK to omit CDS and CDNSKEY
sinec they don't have any separate IANA considerations :-)

Is it possible to ask IANA to combine the registries a bit? I would prefer
it if there were one page of DNS parameter assignments, or maybe two with
a separate page for DNSSEC. At the moment there are:

https://www.ietf.org/assignments/dns-parameters
https://www.ietf.org/assignments/dns-sec-alg-numbers
https://www.ietf.org/assignments/dnskey-flags
https://www.ietf.org/assignments/dnssec-nsec3-parameters
https://www.ietf.org/assignments/sig-alg-numbers

And https://www.ietf.org/assignments/tsig-algorithm-names
which is misfiled - it is not listed under the DNS heading at
https://www.ietf.org/assignments/

Tony.
-- 
f.anthony.n.finch  <[email-masked]>  http://dotat.at/
defend the right to speak, write, worship, associate, and vote freely