Subject: Re: [dnsext] draft-ietf-dnsext-dnssec-algo-imp-status-00.txt

From: Samuel Weiler <[email-masked]>
Date: Wed, 1 Feb 2012 09:42:16 -0500 (EST)

On Tue, 31 Jan 2012, Edward Lewis wrote:

> Not really.  We only needed an NSEC3-ized RSA/SHA-1 to deal with backward 
> compatibility issues at the time.  From here out, any "new" DNSSEC 
> "algorithm" will be defined for NSEC3 and NSEC.
>
> And - for RSASHA1-NSEC3-SHA1, the -SHA1 is there twice!

The trailing -SHA1 refers to the NSEC3 name hashing algorithm.  That 
could be different from the hash algorithm used in signing (and, in 
the case of RSASHA256 and RSASHA512, they are indeed different).  I 
think there's a plausible arugment that the mnemonics defined in 
RFC5702 should have been RSASHA256-SHA1 and RSASHA512-SHA1.

-- Sam

_______________________________________________
dnsext mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dnsext