Subject: Re: [dnsext] Cryptographic Algorithm Identifier Allocation for DNSSEC

From: "Jeffrey A. Williams" <[email-masked]>
Date: Thu, 27 Aug 2009 16:27:29 -0400 (EDT)

Patrik and all,

  I think th opposite is true.  We cannot risk having non-interoperability
because any entity prefers to use it's own crypto algorithm.  There may
be good reason for them to do so from their point of view.

-----Original Message-----
>From: Patrik Fältström <[email-masked]>
>Sent: Aug 27, 2009 12:13 AM
>To: Paul Hoffman <[email-masked]>
>Cc: Olafur Gudmundsson <[email-masked]>, Basil Dolmatov <[email-masked]>, Dan Simon <[email-masked]>, Gordon Lennox <[email-masked]>, "[email-masked] WG" <[email-masked]>
>Subject: Re: [dnsext] Cryptographic Algorithm Identifier Allocation for    DNSSEC
>
>On 27 aug 2009, at 00.08, Paul Hoffman wrote:
>
>> The out-of-band feedback in DNSSEC ("why is your domain bogus?")  
>> will be infinitely more effective than the out-of-band feedback for  
>> signature failures in TLS or S/MIME. Really: the market will truly  
>> count here.
>
>The feedback will not be "why is your domain bogus". Your feedback,  
>when you try to access a website, and you can not, is to call your own  
>ISP and say "why is your DNS server broken". And the ISP then have two  
>choices: Bite their tongue and calm the customer down, or stop  
>verifying DNSSEC signed responses.
>
>We can _not_ risk having non-interoperability of DNSSEC globally by  
>having everyone picking their own crypto algorithm.
>
>    Patrik
>
Regards,

Jeffrey A. Williams
Spokesman for INEGroup LLA. - (Over 294k members/stakeholders strong!)
"Obedience of the law is the greatest freedom" -
   Abraham Lincoln

"Credit should go with the performance of duty and not with what is very
often the accident of glory" - Theodore Roosevelt

"If the probability be called P; the injury, L; and the burden, B; liability
depends upon whether B is less than L multiplied by
P: i.e., whether B is less than PL."
United States v. Carroll Towing  (159 F.2d 169 [2d Cir. 1947]
===============================================================
Updated 1/26/04
CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of
Information Network Eng.  INEG. INC.
ABA member in good standing member ID 01257402 E-Mail [email-masked]
Phone: 214-244-4827