Subject: Protocol numbers for RSA/SHA{256|512} (Was: Re: [dnsext] GOST DNSSEC, implementations?)

From: Doug Barton <[email-masked]>
Date: Mon, 19 Oct 2009 14:16:59 -0700

Andrew Sullivan wrote:
> On Fri, Sep 25, 2009 at 09:40:21PM -0700, Doug Barton wrote:
> 
>> IANA could kill two birds with one stone by not assigning 8-11 "in the
>> foreseeable future" and assigning something totally different to
>> RSA/SHA{256|512}.
> 
> Actually, in consultation with IANA, we've determined that we'll
> assign the identifiers in the 8-11 range

I see based on
http://www.iana.org/assignments/dns-sec-alg-numbers/dns-sec-alg-numbers.xhtml
that the decision to use the numbers that were already shipped seems
to have been finalized.

---

From: Andrew Sullivan <[email-masked]>
Date: Mon, 19 Oct 2009 20:14:46 -0400

Hi,

I didn't see an argument that seemed like, "This is harmful," where  
harm was defined otherwise than, "It's in bad taste."  I don't think  
bad taste is enough, and as I argued before, I think the precedent  
argument is bogus (and I'm prepared to meet it in future). Of course,  
we do not yet have an RFC, and if the issue is important enough to  
anyone to change, now would be the time to make loud screeching  
noises. I won't speak for Olafur, but I regard my role in this as  
being the instrument of the WG's will. I think I got it right, but I'm  
ever open to correction.

A

-- 
Andrew Sullivan
<[email-masked]>

---

From: Doug Barton <[email-masked]>
Date: Thu, 22 Oct 2009 11:54:34 -0700

Andrew Sullivan wrote:
> Hi,
> 
> I didn't see an argument that seemed like, "This is harmful," where harm
> was defined otherwise than, "It's in bad taste."  I don't think bad
> taste is enough, and as I argued before, I think the precedent argument
> is bogus (and I'm prepared to meet it in future).

I think that there are numerous flaws in your logic here, but given
that A) You don't find my arguments persuasive, and B) No one else in
the WG has spoken up explicitly to say that they also believe that
different numbers should be assigned, I am willing to let the matter
drop assuming no one else agrees that it should be pursued.

FWIW, the most egregious flaw in your logic is that it is possible to
"meet" the precedent argument in the future. Your decision seems to
rest on two pillars, the first being that Jelte had "a good reason" to
ship code with those two numbers and that "interoperability" is
important to maintain in this situation (in spite of the fact that the
feature was marked experimental, is incredibly unlikely to have any
critical deployments at this point, is not enabled in more recent
releases, etc. etc.).

Given these two points, the next person/group/organization that picks
their own code points and ships code with them will fall into exactly
the same category. They will have a "good reason" to have done so,
reinforced by this precedent (and others in the past) and will have at
least as strong an argument on the interoperability front (given that
the current argument is flimsy at best). So are you going to draw the
line in the sand next time when it might actually break something, or
do you draw the line in the sand this time when the organization in
question has explicitly stated that "The code using these code points
has been disabled in more recent releases," and "you would also not
meet with any resistance if other code points would be assigned?"

Or maybe we just have no lines? After all there are hundreds of
unassigned code points in that registry (and most of the others for
that matter). Who really cares if we just start appropriating them?

Finally I'd like to reiterate my point that this is not an attack
against Jelte personally, NLnet Labs, Andrew, or anyone else. Mistakes
happen, and I'm sure I'll make some of my own someday. :) However in
my mind this principle is incredibly important, based on my experience
of having dealt with the fallout when I was at IANA. However if no one
else agrees that this is something worth pursuing, so be it.

Doug (... and no sand for that matter)

-- 

	Improve the effectiveness of your Internet presence with
	a domain name makeover!    http://SupersetSolutions.com/

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Wed, 28 Oct 2009 14:58:21 +0100

On Mon, Oct 19, 2009 at 02:16:59PM -0700,
 Doug Barton <[email-masked]> wrote 

> http://www.iana.org/assignments/dns-sec-alg-numbers/dns-sec-alg-numbers.xhtml

Anyone knows an example of keys and signatures using algorithms 8 or
10, in the wild? This is for a blog entry I want to write.