Subject: Re: [dnsext] Signing the root with SHA-1 or SHA-2

From: William Allen Simpson <[email-masked]>
Date: Sat, 01 Aug 2009 19:04:16 -0400

Andrew Sullivan wrote:
> On Fri, Jul 31, 2009 at 07:22:47PM -0400, William Allen Simpson wrote:
>> Aim for retiring SHA-1 by April 1st.
> 
> One is tempted to read that suggestion as significant.
> 
The dates were chosen to end on that date for the humor effect. ;-)

My guess is after aiming for 2 interoperable implementations, the timing
might slip.  But April 1st has the advantage in the northern hemisphere
that it's at least a few weeks before most schools empty for the summer,
and before most companies have many vacations, meaning we'd get better
feedback and bang for the buck.

By contrast, the previously suggested December 31st is a terrible time to
do a rollover....

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: "Jeffrey A. Williams" <[email-masked]>
Date: Sat, 01 Aug 2009 17:47:48 -0700

Will and all,

  I agree, December is a terrible month to do anything or any real
significance...  Same is true of November, BTW...

> By contrast, the previously suggested December 31st is a terrible time to

Regards,

Spokesman for INEGroup LLA. - (Over 284k members/stakeholders strong!)
"Obedience of the law is the greatest freedom" -
   Abraham Lincoln
"YES WE CAN!"  Barack ( Berry ) Obama

"Credit should go with the performance of duty and not with what is
very often the accident of glory" - Theodore Roosevelt

"If the probability be called P; the injury, L; and the burden, B;
liability depends upon whether B is less than L multiplied by
P: i.e., whether B is less than PL."
United States v. Carroll Towing  (159 F.2d 169 [2d Cir. 1947]
===============================================================
Updated 1/26/04
CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS.
div. of Information Network Eng.  INEG. INC.
ABA member in good standing member ID 01257402 E-Mail
[email-masked]
My Phone: 214-244-4827

---

From: Alex Bligh <[email-masked]>
Date: Sun, 02 Aug 2009 10:09:50 +0100

> significance...  Same is true of November, BTW...

I find the same applies with January to October inclusive...

-- 
Alex Bligh

---

From: "Jeffrey A. Williams" <[email-masked]>
Date: Sun, 02 Aug 2009 17:16:43 -0700

Alex and all,

  January yeah, I am not sure about October though...

Regards,

---

From: [email-masked]
Date: Mon, 3 Aug 2009 00:49:01 +0000

so, why don't you poll your 284,000 members/stakeholders
 and come back with a date thats good for you and i'm sure 
 that the rest of the 1,000,000,000 folks on the Internet
 will be able to come to some agreement on the date/time
 that does not otherwise conflict with vacations, holidays,
 religious observence, sleep cycles, education, family
 demands, or other critical events in our lives.

 i promise that i won't be washing the cat or plucking my
 eyebrows then...  

--bill (who is fine w/ 25dec, 31dec, 01jan, the friday before
	a five day weekend...   pretty much any time is good,
	AS LONG AS IT IS ANNOUNCED WITH SOME LEADTIME, SAY
	AT LEAST A MONTH...)

---

From: Michael Richardson <[email-masked]>
Date: Tue, 04 Aug 2009 11:29:19 -0400

[ Moderators note: Post was moderated, either because it was posted by
   a non-subscriber, or because it was over 20K.  
   With the massive amount of spam, it is easy to miss and therefore 
   delete relevant posts by non-subscribers. 
   Please fix your subscription addresses. ]

>>>>> "Joe" == Joe Abley <[email-masked]> writes:
    Joe> On 31-Jul-2009, at 10:42, Michael Richardson wrote:

    >> but having two signatures for any length of time on things like
    >> ".com IN NS" may be a concern.

    Joe> Note that delegation NS RRSets in the root zone (and glue A and
    Joe> AAAA RRSets) will not be signed. Those sets get signed in the
    Joe> zones which are authoritative for them.

  Good point.
  I had done a dig on .com NS and some other ccTLDs to see how
frequently they had added more NS records until they hit the reply size
limit. 

-- 
]     Y'avait une poule de jammé dans l'muffler!!!!!!!!!        |  firewalls  [
]   Michael Richardson, Sandelman Software Works, Ottawa, ON    |net architect[
] [email-masked] http://www.sandelman.ottawa.on.ca/ |device driver[
]    h("Just another Debian GNU/Linux using, kernel hacking,    ruby  guy");  [

---

From: Mark Andrews <[email-masked]>
Date: Wed, 05 Aug 2009 10:11:13 +1000

In message <[email-masked]>, Michael Richardson writes:
> >>>>> "Joe" =3D=3D Joe Abley <[email-masked]> writes:
> limit.=20

	Referrals are not and will not be the issue.  Referrals
	usually have 1 (2 with NSEC3) RRSIG set.  NXDOMAIN is the
	expensive response with 3 (4 with NSEC3) RRSIG sets.

	Mark
 
> --=20
> ]     Y'avait une poule de jamm=E9 dans l'muffler!!!!!!!!!        |  firewa=
> lls  [
> ]   Michael Richardson, Sandelman Software Works, Ottawa, ON    |net archit=
> ect[
> ] [email-masked] http://www.sandelman.ottawa.on.ca/ |device dri=
> ver[
> ]    h("Just another Debian GNU/Linux using, kernel hacking,    ruby  guy")=
> ;  [
> 
> 
> --
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]