Subject: Re: [dnsext] IANA considerations in the RSA-SHA2 draft

From: Alfred Hönes <[email-masked]>
Date: Thu, 12 Mar 2009 19:15:19 +0100 (MEZ)

My recollection is that the 'new' DNSSEC specs (RFCs 4033-4035 ff.)
had purposely excluded transaction security from consideration.
Cryptographic DNS Transaction security is orthogonal to DNSSEC and
its deployment/use is independent from the deployment/use of DNSSEC.

Hence, SIG(0) and TSIG/TKEY related topics have intentionally been
set aside for potential updates to the related RFCs, and thus,
RFC 4034 _purposely_ did not make any statement on the content of
the "Trans. Sec." column in the "DNS SECURITY ALGORITHM NUMBERS"
IANA registry.

Therefore, with respect to the title of the draft, I regard any
statement on the applicability of the newly specified DNSSEC
algorithms to TSIG as out-of-scope for this draft.
Related considerations should be left to a future independent
specification, which naturally could make a normative reference
to this document, if desired.

In retrospect, it would perhaps have been preferable if RFC 4034
had split the registry, since "Trans. Sec." is no more considered
part of DNSSEC, or if it had changed the registry title.

Until dedicated IANA considerations (perhaps in an update to the
TSIG/TKEY specifications?) say otherwise, I recommend to purposely
leave that column _open_ in any new lines to be entered into the
registry for algorithms (primarily) intended for use in signatures
within the scope of DNSSEC (as specified in RFC 4033-4035).

Kind regards,
  Alfred.

-- 

+------------------------+--------------------------------------------+
| TR-Sys Alfred Hoenes   |  Alfred Hoenes   Dipl.-Math., Dipl.-Phys.  |
| Gerlinger Strasse 12   |  Phone: (+49)7156/9635-0, Fax: -18         |
| D-71254  Ditzingen     |  E-Mail:  [email-masked]                     |
+------------------------+--------------------------------------------+

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Michael StJohns <[email-masked]>
Date: Fri, 13 Mar 2009 14:10:02 -0400

>to this document, if desired.

I think Ed was making a specific statement about the expected response from IANA for the registry and I think he's correct. Simply leaving the column empty (or in the case of the document, omitting it) looks like it was just overlooked in the document.

 I'd suggest making an explicit entry in the table of "*" for the transaction security column and have a related footnote (for the table) that "*" means "There has been no determination of standardization of the use of this algorithm with transaction security" or something along those lines.  This completes the table AND provides an explanation for while the column isn't Y or N which should make IANA happy.

Mike.

---

From: Andrew Sullivan <[email-masked]>
Date: Fri, 13 Mar 2009 15:04:15 -0400

On Fri, Mar 13, 2009 at 02:10:02PM -0400, Michael StJohns wrote:

>  I'd suggest making an explicit entry in the table of "*" for the
> transaction security column and have a related footnote (for the
> table) that "*" means "There has been no determination of
> standardization of the use of this algorithm with transaction
> security" or something along those lines.  

I like this idea, and the document editor says he does too.  So we'll
plan to add it.

If you have additional comments, everyone, now would be a good time to
get them in.  We're going to try to wrap up this document for
publication request soon.

Best,

A (as document shepherd).

-- 
Andrew Sullivan
[email-masked]
Shinkuro, Inc.