Subject: Protocol Action: Domain Name System Security Extensions to Proposed Standard

From: The IESG <[email-masked]>
Date: Fri, 22 Jan 1999 13:30:14 -0500

The IESG has approved publication of the following Internet-Drafts as
Proposed Standards:

 o Domain Name System Security Extensions
	<draft-ietf-dnssec-secext2-07.txt>
 o DSA KEYs and SIGs in the Domain Name System
	<draft-ietf-dnssec-dss-03.txt>
 o RSA/MD5 KEYs and SIGs in the Domain Name System (DNS) 
	<draft-ietf-dnssec-rsa-01.txt> 
 o Storing Certificates in the Domain Name System (DNS) 
	<draft-ietf-dnssec-certs-04.txt> 
 o Storage of Diffie-Hellman Keys in the Domain Name System (DNS)
	<draft-ietf-dnssec-dhk-03.txt>

The IESG also approved publication of the following as Experimental:

 o Detached Domain Name System (DNS) Information
	<draft-ietf-dnssec-ddi-06.txt>

and the publication of DNS Operational Security Considerations
<draft-ietf-dnssec-secops-02.txt> as Informational.

These documents are the product of the Domain Name System Security
Working Group.  The IESG contact persons are Jeffrey Schiller and
Marcus Leech.

Technical Summary
 
   These documents define mechanisms that provide data security for the DNS
   infrastructure.  They define a system for establishing a loose trust
   hierarchy using public-key technologies.  New RR types are defined,
   most notably "KEY" and "SIG" RR types to provide for digital signatures
   over collections of RRs protected by the "SIG".  A happy side effect
   is that this system allows the secure publication of public-keys, much
   like the X.509/X.500 scheme.

Working Group Summary

   The working group chair reports that rough consensus exists for
   these documents.  An issue of potential patent problems from Cylink
   was raised during IETF last-call, but the issue was found to be
   without merit--DNS defines only a storage mechanism for Diffie-Hellman
   keys; a compliant implementation need only store DH keys, not engage
   in any DH protocol.

Protocol Quality

    These documents have been reviewed by Marcus Leech for the IESG.  One
    implementation exists, with another under development.