Subject: Re: I-D ACTION:draft-ietf-dnsext-ds-sha256-00.txt

From: Roy Arends <[email-masked]>
Date: Sun, 13 Nov 2005 19:08:03 +0100

Wes,

On Fri, 11 Nov 2005 [email-masked] wrote:

> A New Internet-Draft is available from the on-line Internet-Drafts directories.
> This draft is a work item of the DNS Extensions Working Group of the IETF.
>
> 	Title		: Use of SHA-256 in DNSSEC Delegation Signer (DS) Resource Records (RRs)
> 	Author(s)	: W. Hardaker
> 	Filename	: draft-ietf-dnsext-ds-sha256-00.txt
> 	Pages		: 7
> 	Date		: 2005-11-11
>
>    This document defines the use of the SHA-256 digest type for creating
>    digests of DNSKEY Resource Records (RRs).  These digests can then be
>    published in Delegation Signer (DS) resource records (RRs) by a
>    parent zone.

Good work. I'd like to see this advanced asap.

However, I'd like to see (something like) the following text added in
section 4 as a motivation for supporting both digest types for two years,
since that might be perceived as counter-intuititive:

4.  Deployment Requirements

   If a validator does not support the SHA-256 digest type in an
   authenticated DS RRset, then the validator has no supported
   authentication path leading from the parent to the child.  The
   resolver should treat this case as it would be the case of an
   authenticated NSEC RRset proving that no DS RRset exists, as
   described in RFC 4035, section 5.2.

   Therefore, deployments SHOULD publish both SHA-1 and SHA-256
   based DS records for 2 years from the publication date of this
   RFC (XXX: RFC Editor: Please insert the calculated date here).

Regards,

Roy

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>