Subject: Re: Q2: crypto algorithm requirements for DNSSEC

From: "Scott Rose" <[email-masked]>
Date: Wed, 12 Feb 2003 13:33:06 -0500

Correct.  I was taking "implementation" to mean "the resolver should be
capable of verifying a SIG using algorithm X"    That is slightly different
that saying that all zone RR sets must have SIGs using multiple algorithms.

Although that point does deserve discussion:   If DSA is still  "REQUIRED",
does that mean each zone should have both a RSA/SHA1 SIG and DSA SIG for
each RR set?

I'm asking becuase I don't know what the answer should be.  I don't know if
there is a concensus what entails when there are multiple REQUIRED
algorithms.

Scott
(term nitpick - my use of "resolver" is used to mean "a security aware
resolver/verifier" in the above).

----- Original Message -----
From: "Loomis, Rip" <[email-masked]>
>
> > There has been previous talk on this list regarding dropping DSA as a
> > mandatory to implement algorithm.  Instead of writing a whole RFC just
to
> > propose making DSA optional and RSA/SHA1 the only required algorithm, it
> > would be nice to seek consensus here.
>   [Table and other discussion elided]
> > Q:  Is the change of DSA to OPTIONAL  acceptable?  That will leave only
> > RSA/SHA1 as the only mandatory to implement algorithm.
>
> I agree that any requirement that folks MUST USE both RSA and DSA (must
> sign each record with both) is over-engineering, and actually provides
> no added security while having a significant operational cost (sorry,
> have to disagree with Mark A. on this one).
>
> I don't think that's what Scott originally asked, though, which is why
> I piped up in the first place.  Did I miss something?
>
>   --Rip
>
> --
> to unsubscribe send a message to [email-masked] with
> the word 'unsubscribe' in a single line as the message text body.
> archive: <http://ops.ietf.org/lists/namedroppers/>

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Miek Gieben <[email-masked]>
Date: Thu, 13 Feb 2003 10:19:29 +0100

[ post by non-subscriber.  with the massive amount of spam, it is easy to miss
  and therefore delete posts by non-subscribers.  if you wish to regularly
  post from an address that is not subscribed to this mailing list, send a
  message to <listname>[email-masked] and ask to have the alternate
  address added to the list of addresses from which submissions are
  automatically accepted. ]

[On 12 Feb, @19:33, Scott wrote in "Re: Q2: crypto algorithm requi ..."]
> there is a concensus what entails when there are multiple REQUIRED

I'm not sure what the answer should be, but I don't think a TLD will ever want
to support two different algorithms in a zone,

grtz Miek

---

From: Jakob Schlyter <[email-masked]>
Date: Thu, 13 Feb 2003 11:25:34 +0100 (MET)

On Thu, 13 Feb 2003, Miek Gieben wrote:

> I'm not sure what the answer should be, but I don't think a TLD will
> ever want to support two different algorithms in a zone,

why? due to zone size constraints? I do not agree.

	jakob