IETF Logo Mail Archive

Re: [dnsext] DNSSEC, robustness, and several DS records

Francis Dupont <Francis.Dupont@fdupont.fr> Wed, 11 May 2011 22:50 UTC

Return-Path: <Francis.Dupont@fdupont.fr>
X-Original-To: dnsext@ietfa.amsl.com
Delivered-To: dnsext@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BBFD9E0870 for <dnsext@ietfa.amsl.com>; Wed, 11 May 2011 15:50:31 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.599
X-Spam-Level:
X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id T0VT66auB7yf for <dnsext@ietfa.amsl.com>; Wed, 11 May 2011 15:50:31 -0700 (PDT)
Received: from givry.fdupont.fr (givry.fdupont.fr [IPv6:2001:41d0:1:6d55:211:5bff:fe98:d51e]) by ietfa.amsl.com (Postfix) with ESMTP id C7381E07F0 for <dnsext@ietf.org>; Wed, 11 May 2011 15:50:30 -0700 (PDT)
Received: from givry.fdupont.fr (localhost [127.0.0.1]) by givry.fdupont.fr (8.14.3/8.14.3) with ESMTP id p4BMoQZk020211; Thu, 12 May 2011 00:50:26 +0200 (CEST) (envelope-from dupont@givry.fdupont.fr)
Message-Id: <201105112250.p4BMoQZk020211@givry.fdupont.fr>
From: Francis Dupont <Francis.Dupont@fdupont.fr>
To: Brian Dickson <brian.peter.dickson@gmail.com>
In-reply-to: Your message of Wed, 11 May 2011 17:04:05 EDT. <BANLkTimfRQ=n0zKbEQa4A4028+DrgDu=6Q@mail.gmail.com>
Date: Thu, 12 May 2011 00:50:26 +0200
Sender: Francis.Dupont@fdupont.fr
Cc: Paul Hoffman <paul.hoffman@vpnc.org>, dnsext@ietf.org
Subject: Re: [dnsext] DNSSEC, robustness, and several DS records
X-BeenThere: dnsext@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: DNS Extensions working group discussion list <dnsext.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsext>, <mailto:dnsext-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/dnsext>
List-Post: <mailto:dnsext@ietf.org>
List-Help: <mailto:dnsext-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsext>, <mailto:dnsext-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 11 May 2011 22:50:31 -0000

 In your previous mail you wrote:

   What Paul is (I believe) indicating is that doing the latter isn't quite in
   keeping with the general spirit of the RFC, or in the "be liberal in what
   you accept" philosophy.
   
=> The RFC says:

   Validator implementations SHOULD ignore DS RRs containing SHA-1
   digests if DS RRs with SHA-256 digests are present in the DS RRset.

so it doesn't say "valid" SHA-256 digests or something else.
I am sorry but there is one possible interpretation of the text,
of course we can agree the text is bad (:-). BTW I already signaled
there is no guideline for other (than SHA-1 and SHA-256) digest
algorithms so anyway a new document is needed...

Regards

Francis.Dupont@fdupont.fr

PS: IMHO the idea of RFC 4509 is to replace SHA-1 by SHA-256
(and Paul shoud remark there is no well founded cryto reasons
to do that) so to provide both SHA-1 and SHA-256 is something
for the (now in the past) transitioning phase...

v2.23.0 | Report a Bug | By Email