Subject: About draft-ietf-dnsext-ecc-key-07.txt, absence of algorithm restriction in ECC public key encoding

From: Thierry Moreau <[email-masked]>
Date: Mon, 15 Aug 2005 09:14:46 -0400

Dear all:

A quick question/comment about the draft 
draft-ietf-dnsext-ecc-key-07.txt, "Elliptic Curve KEYs in the DNS". In 
this draft document, I didn't see any indication of public key algorithm 
to be used with a given public key (e.g. the same RSA public key value 
can be used with SHA-1 or MD5 for signatures, and a different DNSKEY RR 
encoding prevents an RSA-SHA-1 key to be diverted to RSA-MD5). This is 
somehow different from key usage, i.e. whether DNS zone signing allowed.

For instance of algorithm restriction with ECC public keys, see the 
draft-ietf-pkix-ecc-pkalgs-01.txt

Am I correct in reading the draft draft-ietf-dnsext-ecc-key-07.txt as 
omitting algorithm restrictions? If yes, I see a difficulty with 
algorithm change threat once the ECC crypto is applied to DNS. Thus, I 
would expect the ECC public key format to be reworked before applied to DNS.

Regards,

-- 

- Thierry Moreau

CONNOTECH Experts-conseils inc.
9130 Place de Montgolfier
Montreal, Qc
Canada   H2M 2A1

Tel.: (514)385-5691
Fax:  (514)385-5900

web site: http://www.connotech.com
e-mail: [email-masked]

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: "The Purple Streak, Hilarie Orman" <[email-masked]>
Date: Sun, 21 Aug 2005 16:11:43 -0600

draft-ietf-dnsext-ecc-key-07.txt, "Elliptic Curve KEYs in the DNS" discusses
the representation of ECC keys, not the algorithms for using the keys.
PKIX chose to define both in one document.

Hilarie