Subject: [DNSOP] Murray Kucherawy's No Objection on draft-ietf-dnsop-dnssec-iana-cons-04: (with COMMENT)

From: Murray Kucherawy via Datatracker <[email-masked]>
Date: Sat, 02 Oct 2021 21:23:09 -0700

Murray Kucherawy has entered the following ballot position for
draft-ietf-dnsop-dnssec-iana-cons-04: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/blog/handling-iesg-ballot-positions/
for more information about how to handle DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-dnsop-dnssec-iana-cons/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

The Document Quality section of the shepherd writeup appears to be incomplete.

In Security Considerations, it says:

   Security decisions about
   which algorithms are safe and not safe should be made by reading the
   security literature, not by looking in IANA registries.

Should this document request addition of a note to this effect on the registry page itself?

---

From: Paul Hoffman <[email-masked]>
Date: Sun, 3 Oct 2021 16:39:41 +0000

I don't think so, because it is true of every IANA registry page that lists crypto algorithms. Or, if you feel such a notice should be this registry, it should probably be in every similar registry, and that could be enacted by a separate Internet Draft that lists the myriad crypto algorthms.

--Paul Hoffman

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Mon, 4 Oct 2021 19:30:04 -0700

On Sun, Oct 3, 2021 at 9:39 AM Paul Hoffman <[email-masked]> wrote:

> I don't think so, because it is true of every IANA registry page that
> lists crypto algorithms. Or, if you feel such a notice should be this
> registry, it should probably be in every similar registry, and that could
> be enacted by a separate Internet Draft that lists the myriad crypto
> algorthms.
>

I'm just trying to suggest a way to put this advice where it will be seen.
That is, it seems to me the people you're seeking to address -- those that
rely on IANA registries for implementation guidance, rather than documents
-- aren't going to read this document either, and will continue finding
that advice in registries and elsewhere.  Seems to me the way to reach them
is via a note in the registry.

Your call though.  If indeed this admonition would need to appear in many
places to be useful, I wouldn't expect this document to take care of all of
that.

-MSK

---

From: Tim Wicinski <[email-masked]>
Date: Mon, 4 Oct 2021 22:52:33 -0400

On Mon, Oct 4, 2021 at 10:30 PM Murray S. Kucherawy <[email-masked]>
wrote:

> I'm just trying to suggest a way to put this advice where it will be
> seen.  That is, it seems to me the people you're seeking to address --
> those that rely on IANA registries for implementation guidance, rather than
> documents -- aren't going to read this document either, and will continue
> finding that advice in registries and elsewhere.  Seems to me the way to
> reach them is via a note in the registry.
>
Wouldn't a mention of RFC8624 be relevant in this case?
(I'm thinking https://www.rfc-editor.org/rfc/rfc8624.html#page-5)

---

From: Paul Hoffman <[email-masked]>
Date: Tue, 5 Oct 2021 14:42:15 +0000

On Oct 4, 2021, at 7:52 PM, Tim Wicinski <[email-masked]> wrote:
> (I'm thinking https://www.rfc-editor.org/rfc/rfc8624.html#page-5 [rfc-editor.org])

It would be, but it would also be relevant in other IANA registries as well. Other protocols also have 8624-like RFCs, and therefore they might useful to mention in the associated crypto registries. If the IESG wants to expand what goes into IANA registries to include "see also" type references for security, I think that it should be done uniformly, and the effort should be led by the IESG, not the narrow Internet Draft where someone noticed the issue.

--Paul Hoffman