IETF Logo Mail Archive

Re: [DNSOP] on staleness of code points and code (mentions MD5 commentary from IETF98)

Philip Homburg <pch-dnsop-2@u-1.phicoh.com> Wed, 29 March 2017 09:05 UTC

Return-Path: <pch-bF054DD66@u-1.phicoh.com>
X-Original-To: dnsop@ietfa.amsl.com
Delivered-To: dnsop@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 39701129666 for <dnsop@ietfa.amsl.com>; Wed, 29 Mar 2017 02:05:07 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.9
X-Spam-Level:
X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id i5EpArfe7tWA for <dnsop@ietfa.amsl.com>; Wed, 29 Mar 2017 02:05:05 -0700 (PDT)
Received: from stereo.hq.phicoh.net (stereo6-tun.hq.phicoh.net [IPv6:2001:888:1044:10:2a0:c9ff:fe9f:17a9]) by ietfa.amsl.com (Postfix) with ESMTP id EAD78129426 for <dnsop@ietf.org>; Wed, 29 Mar 2017 02:05:04 -0700 (PDT)
Received: from stereo.hq.phicoh.net (localhost [::ffff:127.0.0.1]) by stereo.hq.phicoh.net with esmtp (Smail #130) id m1ct9XL-0000FGC; Wed, 29 Mar 2017 11:05:03 +0200
Message-Id: <m1ct9XL-0000FGC@stereo.hq.phicoh.net>
To: dnsop@ietf.org
Cc: Peter van Dijk <peter.van.dijk@powerdns.com>
From: Philip Homburg <pch-dnsop-2@u-1.phicoh.com>
Sender: pch-bF054DD66@u-1.phicoh.com
References: <58D96BC0.9040701@redbarn.org> <20170328024127.GC96991@isc.org> <alpine.DEB.2.11.1703281035190.13590@grey.csi.cam.ac.uk> <m1csoVf-0000FDC@stereo.hq.phicoh.net> <60078F8A-6117-4C27-88F6-1C180395A718@powerdns.com>
In-reply-to: Your message of "Tue, 28 Mar 2017 19:23:16 +0200 ." <60078F8A-6117-4C27-88F6-1C180395A718@powerdns.com>
Date: Wed, 29 Mar 2017 11:05:02 +0200
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/4S13sb1GX3Apigazl7afct59OWg>
Subject: Re: [DNSOP] on staleness of code points and code (mentions MD5 commentary from IETF98)
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop/>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 29 Mar 2017 09:05:07 -0000

In your letter dated Tue, 28 Mar 2017 19:23:16 +0200 you wrote:
>On 28 Mar 2017, at 12:37, Philip Homburg wrote:
>
>> So if would be best if a validator that implements MD5 would still 
>> return
>> NXDOMAIN is validation fails, but would keep the AD-bit clear even if 
>> validation
>> passes for a domain signed using MD5.
>
>In the interest of nitpick correctness, please return SERVFAIL there, 
>not NXDOMAIN :)

Indeed. Though if somebody is foolish enough to sign with MD5, maybe they should
get a NXDOMAIN :-)

v2.23.0 | Report a Bug | By Email