Subject: [DNSOP] I-D Action: draft-ietf-dnsop-rfc5933-bis-06.txt

From: [email-masked]
Date: Fri, 12 Nov 2021 04:56:30 -0800

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Domain Name System Operations WG of the IETF.

        Title           : Use of GOST 2012 Signature Algorithms in DNSKEY and RRSIG Resource Records for DNSSEC
        Authors         : Dmitry Belyavskiy
                          Vasily Dolmatov
	Filename        : draft-ietf-dnsop-rfc5933-bis-06.txt
	Pages           : 9
	Date            : 2021-11-12

Abstract:
   This document describes how to produce digital signatures and hash
   functions using the GOST R 34.10-2012 and GOST R 34.11-2012
   algorithms for DNSKEY, RRSIG, and DS resource records, for use in the
   Domain Name System Security Extensions (DNSSEC).

   This document obsoletes RFC 5933 and updates RFC 8624.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-dnsop-rfc5933-bis/

There is also an htmlized version available at:
https://datatracker.ietf.org/doc/html/draft-ietf-dnsop-rfc5933-bis-06

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-dnsop-rfc5933-bis-06

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Dmitry Belyavsky <[email-masked]>
Date: Fri, 12 Nov 2021 13:59:52 +0100

Dear colleagues,

New version of the draft is uploaded.
The only difference from previous is some nits, many thanks Tim Wicinski
for the nitpicking.

---------- Forwarded message ---------
From: <[email-masked]>
Date: Fri, Nov 12, 2021 at 1:57 PM
Subject: [DNSOP] I-D Action: draft-ietf-dnsop-rfc5933-bis-06.txt
To: <[email-masked]>
Cc: <[email-masked]>

A New Internet-Draft is available from the on-line Internet-Drafts
directories.
This draft is a work item of the Domain Name System Operations WG of the
IETF.

        Title           : Use of GOST 2012 Signature Algorithms in DNSKEY
and RRSIG Resource Records for DNSSEC
        Authors         : Dmitry Belyavskiy
                          Vasily Dolmatov
        Filename        : draft-ietf-dnsop-rfc5933-bis-06.txt
        Pages           : 9
        Date            : 2021-11-12

Abstract:

_______________________________________________
DNSOP mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dnsop

-- 
SY, Dmitry Belyavsky

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Fri, 12 Nov 2021 14:45:58 +0100

On Fri, Nov 12, 2021 at 01:59:52PM +0100,
 Dmitry Belyavsky <[email-masked]> wrote 

> New version of the draft is uploaded.

I would like to have to additions, if you have time:

* a section summarizing the changes since RFC 5933. It seems it is
just GOST R 34.10-2001 replaced by GOST R 34.10-2012?

* an implementation status section (see RFC 7942) listing the
resolvers that can validate with GOST R 34.10 (Unbound, and BIND, it
seems) but also a few domain names signed with it (I knew caint.su but
it apparently disappeared).

---

From: Dmitry Belyavsky <[email-masked]>
Date: Fri, 12 Nov 2021 16:04:04 +0100

Dear Stephane,

> just GOST R 34.10-2001 replaced by GOST R 34.10-2012?

Yes, I will add the corresponding part if it is missing. Both signature and
hash are replaced.

> it apparently disappeared).

It's a more complicated question.

We had to write this document because the former hash and signature
algorithms
are deprecated both in Russia and by IETF. Then we have a chicken-and-egg
problem:
we can't sign domains without codepoints for hash and signature algorithms,
we can't get the codepoints without RFC.

I have an implementation in my private fork of LDNS, BTW.

-- 
SY, Dmitry Belyavsky