Subject: DS & TCR clarifications

From: Sam Weiler <[email-masked]>
Date: Wed, 8 Oct 2003 19:37:15 -0400 (EDT)

1) Section 2.4 of DS-15 says "Algorithm MUST be an algorithm number
assigned in the range 1..251 and the algorithm MUST be allowed to sign
DNS data."  TCR-04 retains types 253 (private, named) and 254
(private, OID), but dropped 252 (indirect), 255 (reserved), and 0
(reserved).  Shouldn't DS be usable with private algorithms, too?  I
propose completely dropping the restriction from the DS draft.

Either way, one of the drafts will probably be editted to make this
explicit -- either DS will remove/change the restriction and
gain a normative reference on TCR, or TCR will immediately
remove/change the restriction.  The question is not which of those
should happen, but what the restriction should be.

2) Does the IANA registry need to include the algorithm mnemonics?  I
think so, since dnssec-records-04 says that DS, RRSIG, and DNSKEY
presentation formats can use mnemonics.  (This will be a change to the
TCR draft.)

2a) Are the mnemonics in records-04, section A.1 correct?  (Some
algorithms need to be removed, but are the mnemonics correct?)

2b) The DS draft says nothing about using mnemonics in the
presentation format (section 2.5).  Do we really want to change that
in DNSSECbis?

-- Sam

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Sam Weiler <[email-masked]>
Date: Thu, 9 Oct 2003 15:54:45 -0400 (EDT)

> algorithms need to be removed, but are the mnemonics correct?)

Answering my own question, since no one else has: no.

records-04 also removed the mnemonics for the flags and protocol
fields.  Is that intentional?

RFC2535 section 7 says:
        Value  Symbol

        001    RSAMD5
        002    DH
        003    DSA
        004    ECC
        252    INDIRECT
        253    PRIVATEDNS
        254    PRIVATEOID

RFC3110 does not define a mnemonic for RSA/SHA-1

The current draft (records-04) says:

   VALUE   Algorithm [mnemonic]       RFC          STATUS
   0      Reserved                    -            -
   1      RSA/MD5 [RSA/MD5]           RFC 2537     NOT RECOMMENDED
   2      Diffie-Hellman [DH]         RFC 2539     OPTIONAL
   3      DSA [DSA]                   RFC 2536     OPTIONAL
   4      elliptic curve [ECC]        TBA          OPTIONAL
   5      RSA/SHA1 [RSA/SHA1]         RFC 3110     MANDATORY
   6-251  available for assignment    -
   252    reserved                    -
   253    private [PRIVATE_DNS]       see below    OPTIONAL
   254    private [PRIVATE_OID]       see below    OPTIONAL
   255    reserved                    -

So the mnemonics for 1 (which is "reserved" in the new registry
anyway), 253, and 254 aren't the ones in 2535, and there never was a
mnemonic for RSA/SHA1.

-- Sam

---

From: Sam Weiler <[email-masked]>
Date: Thu, 9 Oct 2003 15:53:26 -0400 (EDT)

> TCR-04 retains types 253 (private, named) and 254
> (reserved).

OK, I should re-read my own draft before posting: 0 and 255 (and 1)
are still reserved -- even so, why should the DS draft restrict using
them?

-- Sam

---

From: Sam Weiler <[email-masked]>
Date: Fri, 10 Oct 2003 11:51:32 -0400 (EDT)

Next question:

records-04 lists the algorithm status (optional, mandatory, not
recommended)  along with the parameter values and mnemonics.  Should
that in the registry, too?

Also, we need a mnemonic for RSA/SHA-1 (for presentation formats).
Make suggestions, or I'll invent one.

-- Sam

---

From: Sam Weiler <[email-masked]>
Date: Fri, 10 Oct 2003 12:43:09 -0400 (EDT)

> that in the registry, too?

Again, answering my own question: no.  Rather, the TCR draft shouldn't
do that.  It's not in the registry now, we're getting by just fine,
and I don't want the TCR draft to have to tackle the DSA
mandatory/optional thing.  If DNSSECbis wants to add status as a
column in the registry, that's wonderful.

Look for a new -05 that retains SIG and KEY for TKEY (sigh), renames
the new registries (IESG request), and adds mnemonics to the new
registry.

-- Sam

---

From: Jakob Schlyter <[email-masked]>
Date: Fri, 10 Oct 2003 21:32:42 +0200 (CEST)

> Make suggestions, or I'll invent one.

RSASHA1

	jakob