[dnsext] Publication request for draft-ietf-dnsext-dnssec-rsasha256-14.txt
Andrew Sullivan <ajs@shinkuro.com> Fri, 31 July 2009 21:35 UTC
Return-Path: <owner-namedroppers@ops.ietf.org>
X-Original-To: ietfarch-dnsext-archive@core3.amsl.com
Delivered-To: ietfarch-dnsext-archive@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 445FF3A6962; Fri, 31 Jul 2009 14:35:06 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -0.8
X-Spam-Level:
X-Spam-Status: No, score=-0.8 tagged_above=-999 required=5 tests=[AWL=-1.200, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_INFO=1.448, RDNS_NONE=0.1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Z+9odzrQTNGo; Fri, 31 Jul 2009 14:35:05 -0700 (PDT)
Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id CC7093A67B7; Fri, 31 Jul 2009 14:35:04 -0700 (PDT)
Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from <owner-namedroppers@ops.ietf.org>) id 1MWzfJ-000FDb-8r for namedroppers-data0@psg.com; Fri, 31 Jul 2009 21:29:25 +0000
Received: from [208.86.224.201] (helo=mail.yitter.info) by psg.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from <ajs@shinkuro.com>) id 1MWzfE-000FDB-AL for namedroppers@ops.ietf.org; Fri, 31 Jul 2009 21:29:22 +0000
Received: from crankycanuck.ca (host-78-64-88-85.homerun.telia.com [78.64.88.85]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.yitter.info (Postfix) with ESMTPSA id 321962FE8ED6; Fri, 31 Jul 2009 21:29:16 +0000 (UTC)
Date: Fri, 31 Jul 2009 17:29:13 -0400
From: Andrew Sullivan <ajs@shinkuro.com>
To: dnsext-ads@tools.ietf.org
Cc: namedroppers@ops.ietf.org, iesg-secretary@ietf.org
Subject: [dnsext] Publication request for draft-ietf-dnsext-dnssec-rsasha256-14.txt
Message-ID: <20090731212911.GF14838@shinkuro.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
User-Agent: Mutt/1.5.18 (2008-05-17)
Sender: owner-namedroppers@ops.ietf.org
Precedence: bulk
List-ID: <namedroppers.ops.ietf.org>
Esteemed Area Directors, This note requests publication of the following draft: Title : Use of SHA-2 algorithms with RSA in DNSKEY and RRSIG Resource Records for DNSSEC Author(s) : J. Jansen Filename : draft-ietf-dnsext-dnssec-rsasha256-14.txt Date : 2009-07-30 Document shepherd: Andrew Sullivan <ajs@shinkuro.com> The publication request includes a note for IANA, in section 1.d below. (1.a) Who is the Document Shepherd for this document? Has the Document Shepherd personally reviewed this version of the document and, in particular, does he or she believe this version is ready for forwarding to the IESG for publication? Andrew Sullivan; yes; yes. (1.b) Has the document had adequate review both from key WG members and from key non-WG members? Does the Document Shepherd have any concerns about the depth or breadth of the reviews that have been performed? Yes; no. (1.c) Does the Document Shepherd have concerns that the document needs more review from a particular or broader perspective, e.g., security, operational complexity, someone familiar with AAA, internationalization or XML? The document editor sent the document to the security directorate requesting review. A response was received from one member of the security directorate. It might be good if someone else also from the security directorate reviewed the document, because the person responding is also active in the DNSEXT working group. In particular, there was a question about the utility of the SHA-512 definition in here, and particularly whether that definition is acceptable given the limit on key size. (1.d) Does the Document Shepherd have any specific concerns or issues with this document that the Responsible Area Director and/or the IESG should be aware of? For example, perhaps he or she is uncomfortable with certain parts of the document, or has concerns whether there really is a need for it. In any event, if the WG has discussed those issues and has indicated that it still wishes to advance the document, detail those concerns here. Has an IPR disclosure related to this document been filed? If so, please include a reference to the disclosure and summarize the WG discussion and conclusion on this issue. There are two items to note. First, in making a final-pass check, I note that the examples in section 6 have (by mistake) actual algorithm numbers in them instead of {TBD1} and {TBD2}. Because these are just examples, I judge that they may be fixed as an editorial matter, so I didn't want to issue another version of the draft. As a matter for IANA, we would in fact like TBD1 to be 8 and TBD2 to be 10. This is because an early implementation used those two typecodes already. Secondly there is the question about SHA-512 in 1.c. Despite useful and considered feedback received from one commentator, we decided to go ahead leaving that section in because we believed that it does no real harm and because it has taken a surprisingly long time to build consensus around the document in the WG. I found no IPR disclosure in the database. (1.e) How solid is the WG consensus behind this document? Does it represent the strong concurrence of a few individuals, with others being silent, or does the WG as a whole understand and agree with it? I judge the consensus to be strong and broad. A previous version of this document used algorithm aliases for NSEC and NSEC3 application, but several participants strongly objected to that strategy. This version of the document uses one algorithm identifier for both NSEC and NSEC3. The effect of this is that implementations that do not support NSEC3 will not be able to use SHA-2 either. The WG consensus is that, because of announced deployment of NSEC3 in large zones near the root of the DNS, it will be infeasible for a modern DNSSEC implementation not to support NSEC3. (1.f) Has anyone threatened an appeal or otherwise indicated extreme discontent? If so, please summarise the areas of conflict in separate email messages to the Responsible Area Director. (It should be in a separate email because this questionnaire is entered into the ID Tracker.) No. (1.g) Has the Document Shepherd personally verified that the document satisfies all ID nits? (See the Internet-Drafts Checklist and http://tools.ietf.org/tools/idnits/). Boilerplate checks are not enough; this check needs to be thorough. Has the document met all formal review criteria it needs to, such as the MIB Doctor, media type and URI type reviews? The Shepherd has checked the nits. There are no other reviews to perform for this document as far as I understand. (1.h) Has the document split its references into normative and informative? Are there normative references to documents that are not ready for advancement or are otherwise in an unclear state? If such normative references exist, what is the strategy for their completion? Are there normative references that are downward references, as described in [RFC3967]? If so, list these downward references to support the Area Director in the Last Call procedure for them [RFC3967]. Yes; No; Not a downref, but a reference to a non-RFC standard: [FIPS.180-3.2008] National Institute of Standards and Technology, "Secure Hash Standard", FIPS PUB 180-3, October 2008. As near as the Document Shepherd can tell, there is no RFC that outlines FIPS PUB 180-3, but that's what defines SHA-2, so we need the normative reference. (1.i) Has the Document Shepherd verified that the document IANA consideration section exists and is consistent with the body of the document? If the document specifies protocol extensions, are reservations requested in appropriate IANA registries? Are the IANA registries clearly identified? If the document creates a new registry, does it define the proposed initial contents of the registry and an allocation procedure for future registrations? Does it suggest a reasonable name for the new registry? See [RFC5226]. If the document describes an Expert Review process has Shepherd conferred with the Responsible Area Director so that the IESG can appoint the needed Expert during the IESG Evaluation? The IANA consideration does exist. There are reservatiions in a registry requested. The requested algorithm identifiers are marked as {TBD1} and {TBD 2}. See the remarks under item (1.d) above for a request for the actual numbers to be assigned. (1.j) Has the Document Shepherd verified that sections of the document that are written in a formal language, such as XML code, BNF rules, MIB definitions, etc., validate correctly in an automated checker? No such formal language sections are in this document. (1.k) The IESG approval announcement includes a Document Announcement Write-Up. Please provide such a Document Announcement Write-Up? Technical Summary This document describes how to produce RSA/SHA-256 and RSA/SHA-512 DNSKEY and RRSIG resource records for use in the Domain Name System Security Extensions (DNSSEC, RFC 4033, RFC 4034, and RFC 4035). Working Group Summary The DNS Extensions Working Group had consensus to publish the document. A strong objection to an aliasing strategy for algorithm identifiers was lodged at one point, and that has been addressed in this version. Nobody has objected to this change. Document Quality The document received thorough review, and it is expected that vendors supporting DNSSEC will implement SHA-2 once the document is published. The document went through a large number of revisions before submission, reflecting the extensive feedback and detailed comments received. Best regards, Andrew Sullivan DNS Extensions WG Co-Chair -- Andrew Sullivan ajs@shinkuro.com Shinkuro, Inc. -- to unsubscribe send a message to namedroppers-request@ops.ietf.org with the word 'unsubscribe' in a single line as the message text body. archive: <http://ops.ietf.org/lists/namedroppers/>
- [dnsext] Publication request for draft-ietf-dnsex… Andrew Sullivan