Subject: RE: DNSSEC-RECORDS ISSUE: DSA from Mandatory to Optional

From: "Loomis, Rip" <[email-masked]>
Date: Thu, 25 Sep 2003 13:35:05 -0400

Jim Reid wrote:
> I agree with Michael. It would be prudent to have a second algorithm
> as a safety net. No SPoFs and all that. Even though a vulnerability in
> RSA looks unlikely and DNSSEC wouldn't be top of the list of things to
> worry about if that happened.
> 
> I'd prefer the draft to use 2119 language: MUST, SHOULD, MAY and so
> on. OPTIONAL is too fluffy.
> 
> Count this as another vote for a SHOULD for DSA.

I agree with Michael R. and Jim R. in that I believe it is acceptable
to move DSA to an "optional to implement" status, but that it is
appropriate to use RFC 2119 terminology (in this case a SHOULD,
to indicate that it's still a Really Good Idea to implement both
algorithms).  One way to summarize this proposed change:

  Algorithm:
    RSA	- Mandatory  (MUST be implemented)
    DSA	- Optional   (SHOULD be implemented)

  --Rip

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Miek Gieben <[email-masked]>
Date: Fri, 26 Sep 2003 00:01:09 +0200

[On 25 Sep, @19:35, Loomis, wrote in "RE: DNSSEC-RECORDS ISSUE: DSA  ..."]
>     DSA	- Optional   (SHOULD be implemented)

I support this too,

    grtz  Miek

--
"So long and thanks for all the fish" -- Hitchhikers Guide to the Galaxy