IETF Logo Mail Archive

Re: [DNSOP] Call for Adoption draft-wouters-sury-dnsop-algorithm-update

Roy Arends <roy@dnss.ec> Wed, 15 March 2017 10:26 UTC

Return-Path: <roy@dnss.ec>
X-Original-To: dnsop@ietfa.amsl.com
Delivered-To: dnsop@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9AB00129AA3 for <dnsop@ietfa.amsl.com>; Wed, 15 Mar 2017 03:26:22 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.7
X-Spam-Level:
X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=dnss.ec
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ELA3zTz5036J for <dnsop@ietfa.amsl.com>; Wed, 15 Mar 2017 03:26:21 -0700 (PDT)
Received: from mail-wm0-x236.google.com (mail-wm0-x236.google.com [IPv6:2a00:1450:400c:c09::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D8EEE129A9F for <dnsop@ietf.org>; Wed, 15 Mar 2017 03:26:20 -0700 (PDT)
Received: by mail-wm0-x236.google.com with SMTP id t189so19067456wmt.1 for <dnsop@ietf.org>; Wed, 15 Mar 2017 03:26:20 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=dnss.ec; s=google; h=from:content-transfer-encoding:mime-version:subject:date:references :to:in-reply-to:message-id; bh=V5avveUwIOQabihmWQtv4qy3K8OjgFj5bCI8DQS7S10=; b=STf0JtA6Rdg1xpa2tjgqfpIEOAhg5TGfcy1rAl2yE0edWBYLPJ2S/alIiu+3PnfJpA A06rT6n8ZWYH+7W90dGbZXvXujnPM7I38kLVJ23vec6HPq32EhaElQhrLCrlM7Qp5iri mag4rKpblNAWptN0/BXLwa3OnB4ZeGAyXlv+4=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:content-transfer-encoding:mime-version :subject:date:references:to:in-reply-to:message-id; bh=V5avveUwIOQabihmWQtv4qy3K8OjgFj5bCI8DQS7S10=; b=Ppje51z6i18f4/EsJeorr3MQWVslD1FFeQ58Qo9rsYjidN9YRvf2SKJjhAzJaR864F weQ4fhWQ9ISC9XZhETkRPSTcUhI+T+Gylr7IH5PnZEC6w9i+YaU+dYs7tda6zZg5qcPL gcUeGdbf4SM+SVbroSnAs4+Ejymp3A3En7M3jZQHH0rNHPjj1FxViIAed3rdqGjPJR2l LGmkLJ+7AOwtgnt3K4th31ZDADGPyxheLZa4q9VEIRhqC6VQcxCMFnNoxZOhJHYS4HZD saZ9qfXWIBYnVbhKwNeZWeuvWDlKI6S2g2ugMxzfdWTXR0jgMvsjuPdzb3cibMqufbqt ok0Q==
X-Gm-Message-State: AFeK/H3mev+3a13Ld6KLn4zOVhkfSDjVwyqtZ/uu+VtapM12h7JthOJC/aPVQxnWfV/x5w==
X-Received: by 10.28.131.77 with SMTP id f74mr18457199wmd.109.1489573579053; Wed, 15 Mar 2017 03:26:19 -0700 (PDT)
Received: from ?IPv6:2620:f:8000:210:ad06:e502:4ef7:7c7e? ([2620:f:8000:210:ad06:e502:4ef7:7c7e]) by smtp.gmail.com with ESMTPSA id 136sm18897396wmg.12.2017.03.15.03.26.17 for <dnsop@ietf.org> (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 15 Mar 2017 03:26:17 -0700 (PDT)
From: Roy Arends <roy@dnss.ec>
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\))
Date: Wed, 15 Mar 2017 11:26:16 +0100
References: <78013346-6100-f7e6-a3c8-87d2f92533d8@gmail.com> <F40B69DF-6391-4008-A7CD-C85277952D8A@dnss.ec> <alpine.LRH.2.20.1702281627360.22841@bofh.nohats.ca> <920390D7-BFF8-4680-B2D8-488777671DCA@dnss.ec> <alpine.LRH.2.20.1702282052220.28866@bofh.nohats.ca> <AC4C0368-1454-4718-95AF-BB4DDECEF17E@dnss.ec> <alpine.LRH.2.20.1703011221400.15273@bofh.nohats.ca> <76B12F6D-9D53-4FEB-974D-BB4D6DB02F0B@dnss.ec>
To: dnsop <dnsop@ietf.org>
In-Reply-To: <76B12F6D-9D53-4FEB-974D-BB4D6DB02F0B@dnss.ec>
Message-Id: <386E1BBE-258F-4A80-AE8F-6AEEA08F3F14@dnss.ec>
X-Mailer: Apple Mail (2.3259)
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/42Rd1v_RROGPN-XFi51kkxzuGbY>
Subject: Re: [DNSOP] Call for Adoption draft-wouters-sury-dnsop-algorithm-update
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop/>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 15 Mar 2017 10:26:22 -0000

Dear Paul (and wg)

I apologise for the tone. This went south quick and was due to my confrontational style of writing. The secspider-stats are indeed a good indicator, and convinced me that we shouldn’t make SHA1 related DNSKEY algorithms a "MUST NOT”.

In the spirit of being constructive, we (Jakob Schlyter, Matt Larson and I) have written a small draft (draft-arends-dnsop-dnssec-algorithm-update) that does two things:

it changes RSASHA1 from “Must Implement” to “Recommended to Implement”. (RSASHA1 is the only “MUST IMPLEMENT”)
it changes RSASHA256 from “Recommended to Implement” to “Must Implement”. 

The main motivator for this is that implementors have an incentive to move their implementations “default use” away from RSASHA1 (for instance, when a user generates a DNSKEY without specifying an algorithm, or when choosing an algorithm for signing in the presence of more than one algorithm.

This is done in the style of RFC6944, which states that anything that updates the registry table must obsolete RFC6944 (not just update). Therefor, it is as minimal as possible, with no guidelines and no recommendations for the future.

This is NOT a competing draft, though the titles look alike, and I do like to see advice and guidelines for developers and operators in a draft on the BCP track, not proposed standard.

I’m looking forward to discuss this with the working group on the list and during the Chicago IETF DNSOP session.

Warmly

Sometimes Grumpy.
(Roy Arends)

v2.23.0 | Report a Bug | By Email