Subject: Re: Standardize RSA/SHA256 ?

From: Ólafur Guðmundsson /DNSEXT co-chair <[email-masked]>
Date: Fri, 09 Jun 2006 10:12:35 -0400

At 11:41 08/05/2006, Ólafur Guðmundsson /DNSEXT wrote:

>Dear colleagues
>
>The Working group has had a document for the last few months that
>defines a new DNSKEY algorithm RSA/SHA256. Discussion on this
>document has been non existent.
>
>The chairs would like to ask the working group following question:
>Is there support in the working group to add a new RSA algorithm
>to the list of supported algorithms?

There does not seem to be a general consensus on standardizing RSA/SHA256
for signatures now. The main arguments are that from a
security point of view there are no compelling arguments and that
introducing RSA/SHA256 now would add implementation and operational
complexity at the time where that sort of complexity may push back
the deployment.

It should be noted that one of the questions; how doe multiple
algorithms play together with NSEC and NSEC3 is currently being
addressed in the NSEC3 work and has been described in the
"experiments" draft. We think that once NSEC3 is finished and we have
seen some pick up in deployment we should revisit the SHA256
signature issue. Then we have more operational experience to address
the operational issues too.

The chairs thank the document editor for his work on this document.

         Olaf & Olafur  

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>