IETF Logo Mail Archive

Re: [DNSOP] [Ext] Call for Adoption: draft-hardaker-dnsop-rfc8624-bis, must-not-sha1, must-not-ecc-gost

Peter Thomassen <peter@desec.io> Thu, 02 May 2024 08:27 UTC

Return-Path: <peter@desec.io>
X-Original-To: dnsop@ietfa.amsl.com
Delivered-To: dnsop@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E62F8C14CE25 for <dnsop@ietfa.amsl.com>; Thu, 2 May 2024 01:27:24 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.896
X-Spam-Level:
X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=a4a.de
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UcdaL6dN7rsH for <dnsop@ietfa.amsl.com>; Thu, 2 May 2024 01:27:20 -0700 (PDT)
Received: from mail.a4a.de (mail.a4a.de [IPv6:2a01:4f8:10a:1d5c:8000::8]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-256) server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7E7C1C14F5E2 for <dnsop@ietf.org>; Thu, 2 May 2024 01:27:20 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=a4a.de; s=20170825; h=Content-Transfer-Encoding:Content-Type:In-Reply-To:From: References:To:Subject:MIME-Version:Date:Message-ID:Sender:Reply-To:Cc: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=TS9jGD0JyAtuMd2/lrYiJUgr5YFbKnxh7FjJLJ5Qv6c=; b=d6ODaoiRqZiolOMJ3X5ri9YXCL lQAMRjwRDyrqQ+lI5uEA1VL7o/O8xqwgmn8gHfm62RmoWVn1Sg6oqu8Bb4R5ERrJeLpaPiLCl0RMx EoIBDURTfwgss+pw37sZaG7nOUU0A4cb9usI/wIc5UeZhDHSroKgUDYG4gEdNrgWHmPd7N3x7o7dk 2s3ANJY6S3KWG8L2IYHrFqmq0ARfk2NGykQqzR4Ob0NXKqShUsIQPGCN0m+SFhvgPV7urOIxQlH8B N7lp5/ThJGJuncYfVqTjuWqMtm4rVV9Sf0AOIIqVrsTAMmFx6XjdF1jG86DkqTeSqTg04R8XI/jpq dMvj/NHg==;
Received: from [2a02:8109:9283:8800:7923:1557:a1a6:6dd2] by mail.a4a.de with esmtpsa (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (Exim 4.93) (envelope-from <peter@desec.io>) id 1s2Rmg-000m4a-57; Thu, 02 May 2024 10:27:18 +0200
Message-ID: <0072f7ef-7394-4e81-8206-d0b7040cbf34@desec.io>
Date: Thu, 02 May 2024 10:27:17 +0200
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
To: Philip Homburg <pch-dnsop-5@u-1.phicoh.com>, dnsop@ietf.org
References: <D95A2D1F-1203-4434-B643-DDFB5C24A161@icann.org> <67B93EF4-6B70-402E-9D78-1A079538CA18@strandkip.nl> <m1s1Wur-0000LDC@stereo.hq.phicoh.net> <f0f9c0ce-2911-9b4c-0d60-47c204add2d4@nohats.ca> <m1s1mGR-0000PPC@stereo.hq.phicoh.net> <fbce2996-346f-29fa-3534-45eaa142b96e@nohats.ca> <d73fc09e-c0c4-44f2-a67d-4cf5fafa0863@desec.io> <m1s2R59-0000MgC@stereo.hq.phicoh.net> <97900eaa-b190-472a-9d35-e3fa412b724c@desec.io> <m1s2Reg-0000LsC@stereo.hq.phicoh.net>
Content-Language: en-US
From: Peter Thomassen <peter@desec.io>
In-Reply-To: <m1s2Reg-0000LsC@stereo.hq.phicoh.net>
Content-Type: text/plain; charset="UTF-8"; format="flowed"
Content-Transfer-Encoding: 7bit
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/HuCvC3k1ZCZkAKDA3EiLU5NbKdQ>
Subject: Re: [DNSOP] [Ext] Call for Adoption: draft-hardaker-dnsop-rfc8624-bis, must-not-sha1, must-not-ecc-gost
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop/>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 02 May 2024 08:27:25 -0000


On 5/2/24 10:19, Philip Homburg wrote:
> In your letter dated Thu, 2 May 2024 09:58:43 +0200 you wrote:
>> Right. Their policy may be "it's compliant and it works, so why roll?". It'll
>> be easier to push those SHA-1 signers to switch if one can tell them "look, no
>> w you're not compliant anymore".
> 
> So basically we need a BCP: operators of zones MUST NOT sign their zones
> with algorithms 5 and 7. If they currently do, they need to move away
> from those algorithms as quickly as possible.

I somewhat agree that this could also be done as a BCP. However, a MUST NOT there and a MUST NOT elsewhere is still a MUST NOT, and I'd prefer them to be in the same place as all the other algorithm recommendations.

> To me, that would sound better then trying to break protocols to get people
> to move.

I'm not following what breaks based on the wording I suggested, and I'm not sure why you keep bringing that up. :-)

Peter

-- 
https://desec.io/

v2.46.0 | Report a Bug | By Email | System Status