Subject: draft-ietf-secsh-dns-04.txt

From: Erik Nordmark <[email-masked]>
Date: Mon, 12 May 2003 17:39:39 +0200 (CEST)

If you haven't looked at this draft from the DNS perspective (how the RDATA
is specified; zone file syntax etc) now would be a good time to do that.
It is on the IESG's agenda for this Thursday.

  Erik

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: "Scott Rose" <[email-masked]>
Date: Mon, 12 May 2003 13:46:48 -0400

Making a quick look over of the draft - I don't see anything that could be
an issue at first.  RDATA format is pretty standard (2 bytes and a hex
string).  There are no given restrictions on zone file placement.

The draft requests new IANA registries for algorithm and fingerprint codes
and does not use the DNSSEC algorithm/digest codes.

There might be a need to list some security considerations about relying on
message authentication schemes like TSIG if no SIG RR covers the SSHFP RRset
in a zone.

Scott

---

From: [email-masked]
Date: Tue, 13 May 2003 09:42:00 +1000

> and does not use the DNSSEC algorithm/digest codes.

	DS also uses SHA-1.

	Also the draft needs to be clear about whether mnemonics can be use
	or not in the presentation format for the record.
 
--
Mark Andrews, Internet Software Consortium
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

---

From: Jakob Schlyter <[email-masked]>
Date: Tue, 13 May 2003 05:24:58 +0200 (CEST)

> 	or not in the presentation format for the record.

the draft says nothing about mnemonics and I have no intention to support
them. should I make this non-support explicit?

	jakob

---

From: Jakob Schlyter <[email-masked]>
Date: Tue, 13 May 2003 05:23:02 +0200 (CEST)

> message authentication schemes like TSIG if no SIG RR covers the SSHFP RRset

the draft requires that each SSHFP are covered by a SIG RR.

	jakob

---

From: [email-masked]
Date: Tue, 13 May 2003 13:34:01 +1000

> them. should I make this non-support explicit?

	Yes.