Subject: Re: [dnsext] Draft DNSEXT charter

From: Florian Weimer <[email-masked]>
Date: Mon, 01 Jun 2009 10:39:12 +0200

* Francis Dupont:

>  In your previous mail you wrote:
>
>    * Francis Dupont:
>    
>    > PS: I am sure you know it is critical to get this published and
>    > implemented before 2010.
>    
>    This time frame is impossible to achieve due to the dependency on
>    NSEC3.
>
> => can you detail? Do you mean it is impossible to get it published
> in time? implemented? Or the issue is begin/end of 2010

Wide deployment is two to three years away.  The NSEC3 upgrade is too
large to put in a point release.  Adding a new cryptographic algorithm
might have been possible.

I don't think this is a technical problem.  (It may be a compliance
issue.)  It just sugests that DNSSEC doesn't offer that much algorithm
agility.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Francis Dupont <[email-masked]>
Date: Mon, 01 Jun 2009 18:58:45 +0200

> in time? implemented? Or the issue is begin/end of 2010
   
   Wide deployment is two to three years away.

=> I took care to use "published" and "implemented", not "deployed".

   The NSEC3 upgrade is too large to put in a point release.

=> I can't see the point: NSEC3 is already published (March 2008) and
implemented (it is even deployed in .gov). I agree NSEC3 doesn't make
things simpler (:-) but it is orthogonal to RSA-SHA256 for implementations
which already support it.

   Adding a new cryptographic algorithm might have been possible.

=> I can't see the point (and BTW the term "cryptographic algorithm"
is ambiguous because it has a special meaning in the crypto community).

=> DNSSEC has to prove it provides enough algorithm agility but
there is no a priori reason it can't...

Regards

[email-masked]

---

From: Mark Andrews <[email-masked]>
Date: Tue, 02 Jun 2009 10:36:31 +1000

[ Moderators note: Post was moderated, either because it was posted by
   a non-subscriber, or because it was over 20K.  
   With the massive amount of spam, it is easy to miss and therefore 
   delete relevant posts by non-subscribers. 
   Please fix your subscription addresses. ]

In message <[email-masked]>, Francis Dupont write
>    issue.)  It just sugests that DNSSEC doesn't offer that much algorithm

You really can't use RSA-SHA256 as a example of lack of algorithm
agility.  We could have choosen to allocate pairs of code points
one which was not NSEC3 aware and one which was.  RSA-SHA256
deployment would then have been a simple change.  Instead it was
decided to link NSEC3 support and RSA-SHA256.

-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]