Subject: Re: [dnsext]: draft-ietf-dnsext-dnssec-rsasha256-05 -- WGLC

From: Alfred Hönes <[email-masked]>
Date: Thu, 4 Sep 2008 23:53:08 +0200 (MESZ)

[ Moderators note: Post was moderated, either because it was posted by
   a non-subscriber, or because it was over 20K.  
   With the massive amount of spam, it is easy to miss and therefore 
   delete relevant posts by non-subscribers. 
   Please fix your subscription addresses. ]

---  WGLC comments on draft-ietf-dnsext-dnssec-rsasha256-05  ---

Preliminary note:
  I apologize for having been out of sync with the WGLCs in progress
  and appreciate the reminder by the chairs, and the WGLC extensions
  they have announced today in
<http://ops.ietf.org/lists/namedroppers/namedroppers.2008/msg01688.html>.

draft-ietf-dnsext-dnssec-rsasha256  is one of the building blocks
the WG is committed to vs. the IESG for introducing (more) crypto
algorithm agility into all IETF Standards Track security protocols,
and reducing the previous dependency on crypto algorithms that have
increasing public evidence of being much less strong than believed
before.

This draft successfully undertakes the effort to introduce the
newer cryptographic hash functions collectively denoted as SHA-2
into the core DNSSEC protocol elements (DNSKEY and RRSIG resource
records), and it does so in the spirit of, and with minimal
changes to the provisions of, the DNSSEC specs in RFC 4033..4035.
That should make the adoption of this proposal by existing DNSSEC
implementations a rather straightforward and easy task, and it
rises the expectation that this extension will be quickly adopted
by the community supporting the deployment of DNSSEC.

Based on WG consensus, the draft also has integrated support for
one of the most important additions to DNSSEC, NSEC3 (RFC 5111);
the simplified model adopted by the draft assumes NSEC3 support
as a precondition.

In my previous comment posted today,
<http://ops.ietf.org/lists/namedroppers/namedroppers.2008/msg01675.html>,
I have detailed a few issues with the current -05 draft I have
found this week, performing another detailed review of the draft.

In the past, I already had performed a full review of the -02
revision and since then have traced all changes performed to it.
As far as I can see, all issues raised in the past, by reviews
and WG list discussions, have been resolved in these iterations.
(Lack of recent list discussion in fact shows 'silent consensus'
in this case.)

There is only one technical issue in my new review, concerning
section 3 of the draft, and I have proposed text modifications to
cure it, provided that the WG and the author agree to this solution.
The remaining textual flaws also discussed in my review should be
easily addressed as well.

That said, I strongly recommend to proceed with this draft,
performing one more update after WGLC conclusion, based on the
recieved comments (I hope there will be more!), and then hand
it over to the IESG for publication as a Standards Track RFC.

Kind regards,
  Alfred.

-- 

+------------------------+--------------------------------------------+
| TR-Sys Alfred Hoenes   |  Alfred Hoenes   Dipl.-Math., Dipl.-Phys.  |
| Gerlinger Strasse 12   |  Phone: (+49)7156/9635-0, Fax: -18         |
| D-71254  Ditzingen     |  E-Mail:  [email-masked]                     |
+------------------------+--------------------------------------------+

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>