Subject: Re: [dnsext] DNSCURVE

From: Florian Weimer <[email-masked]>
Date: Sun, 31 May 2009 10:27:37 +0200

* Matthew Dempsky:

> If you have questions about DNSCurve that are not adequately answered
> by the dnscurve.org web site, then I'll be happy to try to answer them
> here.

How is the cryptographic box created?  I can't find information on
that on the web pages, only the key agreement protocol is described.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Florian Weimer <[email-masked]>
Date: Sun, 31 May 2009 10:13:35 +0200

* Alex Bligh:

> But, if I understand it, only one particular ECC scheme
> is specified in DNSCurve (i.e. there is no algorithm agility) and
> we don't have an IPR statement on it (or at least not in the IETF
> required manner).

There is algorithm agility in DNSCurve: You just use a different name
(or label) prefix for a different algorithm.  There's a limit on the
number of bits you can transmit (probably around 600 per name server),
but there's still plenty of room for extensions.

Compare this to DNSSEC, where it takes at least three years to
standardize (not even implement and deploy) a non-controversial hash
function replacement. And there is some sentiment (perhaps not
consensus) in the WG that having more than one signature algorithm in
wide production use is undesirable (or maybe not even technically
feasible).