IETF Logo Mail Archive

Re: [DNSOP] [Ext] Call for Adoption: draft-hardaker-dnsop-rfc8624-bis, must-not-sha1, must-not-ecc-gost

Paul Wouters <paul@nohats.ca> Tue, 30 April 2024 23:01 UTC

Return-Path: <paul@nohats.ca>
X-Original-To: dnsop@ietfa.amsl.com
Delivered-To: dnsop@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 47388C169423 for <dnsop@ietfa.amsl.com>; Tue, 30 Apr 2024 16:01:15 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.731
X-Spam-Level:
X-Spam-Status: No, score=-3.731 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_SOFTFAIL=0.665, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nohats.ca
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cLVLQ6kYxX0X for <dnsop@ietfa.amsl.com>; Tue, 30 Apr 2024 16:01:11 -0700 (PDT)
Received: from mx.nohats.ca (mx.nohats.ca [IPv6:2a03:6000:1004:1::85]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 284E4C169425 for <dnsop@ietf.org>; Tue, 30 Apr 2024 16:01:10 -0700 (PDT)
Received: from localhost (localhost [IPv6:::1]) by mx.nohats.ca (Postfix) with ESMTP id 4VTbKJ06BczF21; Wed, 1 May 2024 01:01:08 +0200 (CEST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nohats.ca; s=default; t=1714518068; bh=rQ9NkLJ8QGzIeVEL4B3961OQtEzlZXpylp4M4wXirto=; h=From:Subject:Date:References:Cc:In-Reply-To:To; b=Fhxov5e35rBfK095rcINtzFisOJ14bGRXPVYkfJ0luBbxE2LeD6ciSGn3nCjsNVlW Nr2DLq4bEfaSHKUyakIxGHGjocZQ5k29vnIzKCyNVnwHyRzSCnNSj5koHz4XlxKFRr oBE4Vw5JC8Yj9TyZN3U75pLay3xVZdN7H47b7G/8=
X-Virus-Scanned: amavisd-new at mx.nohats.ca
Received: from mx.nohats.ca ([IPv6:::1]) by localhost (mx.nohats.ca [IPv6:::1]) (amavisd-new, port 10024) with ESMTP id xCsbjsbUt1a1; Wed, 1 May 2024 01:01:06 +0200 (CEST)
Received: from bofh.nohats.ca (bofh.nohats.ca [193.110.157.194]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx.nohats.ca (Postfix) with ESMTPS; Wed, 1 May 2024 01:01:06 +0200 (CEST)
Received: from smtpclient.apple (unknown [193.110.157.210]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by bofh.nohats.ca (Postfix) with ESMTPSA id 5C9CE11DEA49; Tue, 30 Apr 2024 19:01:05 -0400 (EDT)
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
From: Paul Wouters <paul@nohats.ca>
Mime-Version: 1.0 (1.0)
Date: Tue, 30 Apr 2024 19:00:48 -0400
Message-Id: <8BECB257-E7FF-411C-B0E5-C63D07AE1D6E@nohats.ca>
References: <4907A4B7-1EAE-460D-91E8-4F7D292C7302@icann.org>
Cc: Wes Hardaker <wjhns1@hardakers.net>, dnsop <dnsop@ietf.org>
In-Reply-To: <4907A4B7-1EAE-460D-91E8-4F7D292C7302@icann.org>
To: Paul Hoffman <paul.hoffman@icann.org>
X-Mailer: iPhone Mail (21E236)
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/CLsydnswg5ti6rdGGQB7ki7APV4>
Subject: Re: [DNSOP] [Ext] Call for Adoption: draft-hardaker-dnsop-rfc8624-bis, must-not-sha1, must-not-ecc-gost
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop/>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 30 Apr 2024 23:01:15 -0000

On Apr 30, 2024, at 18:42, Paul Hoffman <paul.hoffman@icann.org> wrote:
> 
> This cull-because-of-low usage thread incorrectly assumes that the DNS is flat instead of a hierarchy. The last I saw, there are 14 TLDs who use RSASHA1. Advancing this draft as-is means that all of the zones under those TLDs would be completely wiped out as well. Or maybe that's what the WG wants?

Not wiped out. Being made insecure (versus part of the world only treating them insecure)

It’s worth contacting them for timelines of migration away from SHA1, as RFC 8624 is five years old and that already told them to start moving.

Is that something within the realm of ICANN? Perhaps the DNS Tech Day ? Or perhaps a liaison statement from IETF to ICANN ?

Paul

v2.46.0 | Report a Bug | By Email | System Status