Re: [dnsext] I-D Action: draft-ietf-dnsext-dnssec-algo-signal-04.txt

[Miek Gieben <[e-mail]>]

[ Quoting <[e-mail]> at 08:29 on Mar  6 in "[dnsext] I-D Action:..." ]
> 
> A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the DNS Extensions Working Group of the IETF.
> 
> 	Title           : Signaling Cryptographic Algorithm Understanding in DNSSEC
> 	Author(s)       : Steve Crocker
>                           Scott Rose
> 	Filename        : draft-ietf-dnsext-dnssec-algo-signal-04.txt
> 	Pages           : 8
> 	Date            : 2012-03-06
> 
>    The DNS Security Extensions (DNSSEC) were developed to provide origin
>    authentication and integrity protection for DNS data by using digital
>    signatures.  These digital signatures can be generated using
>    different algorithms.  This draft sets out to specify a way for
>    validating end-system resolvers to signal to a server which
>    cryptographic algorithms and hash algorithms they support.

I read a comment in the draft that this option list can get very long, which
indeed is true. 

How about the following scheme:

A resolver indicates the highest algorithm number it understands and thus *also*
all *previous* algorithms. This way the whole option can be shortened to 4
bytes:

 0: OPTION-CODE
 1: DAU byte value
 2: DHU byte value
 3: N3U byte value

And maybe this option can be renamed to Crypto Understood.

A drawback is that a number of current specified features aren't available
with this scheme.

Regards,
    Miek Gieben