Subject: NSEC3, version 13

From: Roy Arends <[email-masked]>
Date: Fri, 30 Nov 2007 01:28:51 +0100

Dear WG,

This is the latest version of the NSEC3 draft, version 13.

Since the submission deadline for IETF 71 has passed, I've put the latest 
version online:

http://www.nsec3.org/cgi-bin/trac.cgi/attachment/wiki/WikiStart/draft-ietf-dnsext-nsec3-13.txt?format=raw

This version addresses the NSEC3 hash algorithm agility issue.

Changes are:

1) Section 12.1.3 has been replaced with the following text:

12.1.3.  Transitioning to a New Hash Algorithm

   Although the NSEC3 and NSEC3PARAM RR formats include a hash algorithm
   parameter, this document does not define a particular mechanism for
   safely transitioning from one NSEC3 hash algorithm to another.  When
   specifying a new hash algorithm for use with NSEC3, a transition
   mechanism MUST also be defined.  It is possible that the only
   practical and palatable transition mechanisms may require an
   intermediate transition to an insecure state, or to a state that uses
   NSEC records instead of NSEC3.

2) an addition to the IANA considerations:

11. IANA Considerations 
 
   Although the NSEC3 and NSEC3PARAM RR formats include a hash algorithm 
   parameter, this document does not define a particular mechanism for 
   safely transitioning from one NSEC3 hash algorithm to another. When 
   specifying a new hash algorithm for use with NSEC3, a transition 
   mechanism MUST also be defined.

3) One typo was fixed, and two of the authors' addresses have changed

Regards,

Roy Arends
Nominet UK

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Ólafur Guðmundsson /DNSEXT chair <[email-masked]>
Date: Fri, 30 Nov 2007 00:43:49 -0500

Please speak up if this change is of concern to you.
If no one speaks up by Dec 7'th I will tell our AD the changes are
fine.

         Olafur

---

From: Mark Townsley <[email-masked]>
Date: Fri, 30 Nov 2007 13:44:36 +0100

Sam Hartman wrote:
> As an individual, I do not believe it is desirable to publish nsec3
> without a solution to the hash agility problem in hand.  So, I object
> to publishing this draft.
>
> I expect that I'm in the rough on this consensus issue and will not
> block as an AD.  I'd be delighted to find others agree, but doubt that
> a sufficient number will.
>
>
> However, since there are objections, I assume the chairs will also
> call for support;silence in the presence of objections is not rough
> consensus.
>   
I'm not certain without going back and retracing the email threads, but 
I believe there may be enough calls for support in previous versions of 
the document to not ask people to raise their hand, yet again, whether 
they want to see hash agility or not before publishing this document. It 
may not be the exact text of -13 that was available during those 
previous calls, but certainly a version with and without hash agility 
was on the table. I'll leave it up to the Chair to make this call, and 
trust that he has a good backing. Olafur, if you don't have an email 
thread to back you up here, please do ask for one more call for support, 
not just silence, on the hash agility issue and the specific text in 
-13. You can even blame Sam (H) if you like ;-)

- Mark
> Thanks,
> --Sam

---

From: Sam Hartman <[email-masked]>
Date: Fri, 30 Nov 2007 07:28:35 -0500

[ Moderators note: Post was moderated, either because it was posted by
   a non-subscriber, or because it was over 20K.  
   With the massive amount of spam, it is easy to miss and therefore 
   delete relevant posts by non-subscribers. 
   Please fix your subscription addresses. ]

Thanks,

--Sam