Subject: nsec3 with one hash algorithm: SHA-224

From: Roy Arends <[email-masked]>
Date: Sat, 12 Mar 2005 18:10:45 +0100 (CET)

WG,

Rolling hash algorithms (from mandatory to optional) is problematic, as
was previously shown on this list. Since there is also no real profit in
supporting more then one algorithm, we can obsolete the algorithm
field from the RDATA, and settle on a single algorithm for nsec3: SHA-224
(rfc-3874).

Any comments ?

Thanks

Roy

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Ben Laurie <[email-masked]>
Date: Sat, 12 Mar 2005 19:26:32 +0000

Scott Rose wrote:
> I agree with Alex, but if one algorithm is decided on, I would like it to be
> SHA256 at least.  SHA1 was scheduled to be phased out from USG use in '09 (I
> believe) and replaced with SHA256.

SHA-224 is truncated SHA-256. I can certainly live with full length 
SHA-256. I'd argue against SHA-512, since its been pointed out that its 
painful for limited (i.e. not 64 bit) processors to implement.

-- 
http://www.apache-ssl.org/ben.html       http://www.thebunker.net/

"There is no limit to what a man can do or how far he can go if he
doesn't mind who gets the credit." - Robert Woodruff