IETF Logo Mail Archive

[DNSOP] Re: Questions before adopting must-not-sha1

Steve Crocker <steve@shinkuro.com> Wed, 13 November 2024 19:02 UTC

Return-Path: <steve@shinkuro.com>
X-Original-To: dnsop@ietfa.amsl.com
Delivered-To: dnsop@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0CFFBC14F686 for <dnsop@ietfa.amsl.com>; Wed, 13 Nov 2024 11:02:52 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.906
X-Spam-Level:
X-Spam-Status: No, score=-1.906 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_BLOCKED=0.001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, T_SCC_BODY_TEXT_LINE=-0.01] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=shinkuro-com.20230601.gappssmtp.com
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qnSVl38kKnJj for <dnsop@ietfa.amsl.com>; Wed, 13 Nov 2024 11:02:51 -0800 (PST)
Received: from mail-ej1-x631.google.com (mail-ej1-x631.google.com [IPv6:2a00:1450:4864:20::631]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A5775C14F5F1 for <dnsop@ietf.org>; Wed, 13 Nov 2024 11:02:51 -0800 (PST)
Received: by mail-ej1-x631.google.com with SMTP id a640c23a62f3a-a9ec86a67feso1267837066b.1 for <dnsop@ietf.org>; Wed, 13 Nov 2024 11:02:51 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=shinkuro-com.20230601.gappssmtp.com; s=20230601; t=1731524570; x=1732129370; darn=ietf.org; h=to:references:message-id:cc:date:in-reply-to:from:subject :mime-version:content-transfer-encoding:from:to:cc:subject:date :message-id:reply-to; bh=tfASAFc2xKTkeTmDKJtrcIq7a8Zg7WrswGx2W7TdXbE=; b=QWsXd+RiDfWlTFMixRnKdNaLFnnP+NIvARRIw4AHul37N/rInbviOyRorGeaHCCPgl pQ45X2kI5hVaptJ8d+E75EEnoLpbvVyH5I1xZ2nH8UJG4Z99cPC+bRtuxPGJRS4HZtU/ 4c1xas2Be3h93GyoZH5vKYEWH7lNRSgaiSLp45yNga5BrBJwYghNoMk3Qd13tDkmQBH9 T1exxI6VFUV7r5J9te24P6G4zLQW9fQiHVeqf3epw4FiR6nashCjawKqTQktpkL0G6oy 1sDUEqHI+TN8QUira9yLdJNLBxTErnTm4pdImrdDH5qnnn5Lf6sAUAPljJxlAi8TjzHN N7Qg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1731524570; x=1732129370; h=to:references:message-id:cc:date:in-reply-to:from:subject :mime-version:content-transfer-encoding:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=tfASAFc2xKTkeTmDKJtrcIq7a8Zg7WrswGx2W7TdXbE=; b=cVhIbzH2DRjc6ugY8UwaBc+9hZSUMNSCZTtFjCWH+ZyH/h7rh6mIwUWP58QdU1Y/FB GgQJBJr1MCWB+SPlW7lfj6yjdn6kinrc2mJQLe/eBl9q/jmiSq/JUDOuZf29LW4Ocjm9 MsgoAiSUorI7eSg7tjv4UeKk4k1KqQDcr/cnXVcze10d4+18UHS6oUVnFI1c8oLlWQkj C/Gmyx1ohQym9D0yIQoB59AfNGsonqKeNZkdEQZ1tfVGnBzRdHiBf6SKKZsGaw/8I8rJ JctI04sgxvRXSRbnvdAbJlW5RhkOeYD7z4eKQTMpMtkCApFCQFDOMln8KMZENnMIFA7f l03w==
X-Gm-Message-State: AOJu0Yy3mORZ+oTuUnNNYEJWnVUTVYoaYMM8E2ZN3QFIycYDxtOOqhF0 VhPS5oYXzggdmlUI+rwOBkqoCI32diZMCHNQlkcMwcOs6NqUGlzkShaEYXeTWyUhwXQoGsGR1vT Snr4=
X-Google-Smtp-Source: AGHT+IFr8pvOe1AEJcLCHSoNJnadT66ZuVGTN5wJ6agSv3GFmZre1AObWmSiPl6GJ1PGzt5nwvg+pA==
X-Received: by 2002:a17:906:3a92:b0:a99:f8e2:edec with SMTP id a640c23a62f3a-aa1f8926fc4mr291541366b.21.1731524569043; Wed, 13 Nov 2024 11:02:49 -0800 (PST)
Received: from smtpclient.apple ([88.255.70.17]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-a9ee0ad2f76sm893672066b.89.2024.11.13.11.02.48 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Wed, 13 Nov 2024 11:02:48 -0800 (PST)
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Mime-Version: 1.0 (1.0)
From: Steve Crocker <steve@shinkuro.com>
In-Reply-To: <m1tBGeR-0000MfC@stereo.hq.phicoh.net>
Date: Wed, 13 Nov 2024 22:02:37 +0300
Message-Id: <502281DA-5781-47EC-980E-EB912597269E@shinkuro.com>
References: <m1tBGeR-0000MfC@stereo.hq.phicoh.net>
To: Philip Homburg <pch-dnsop-6@u-1.phicoh.com>
X-Mailer: iPhone Mail (22A3370)
Message-ID-Hash: PY532PIQCBMD2XEJYNYLBS2R4NCQ37ZL
X-Message-ID-Hash: PY532PIQCBMD2XEJYNYLBS2R4NCQ37ZL
X-MailFrom: steve@shinkuro.com
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-dnsop.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: dnsop@ietf.org
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [DNSOP] Re: Questions before adopting must-not-sha1
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/fZcxBbc3RzqphIapMnBv_ifA2g8>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Owner: <mailto:dnsop-owner@ietf.org>
List-Post: <mailto:dnsop@ietf.org>
List-Subscribe: <mailto:dnsop-join@ietf.org>
List-Unsubscribe: <mailto:dnsop-leave@ietf.org>

It was the red hat situation that led me to write this.  Red hat should have gone to phase 6, not phase 7.

I recommend moving SHASHA1 to phase 6 for the time being.

Steve

Sent from my iPhone

> On Nov 13, 2024, at 7:55 PM, Philip Homburg <pch-dnsop-6@u-1.phicoh.com> wrote:
> 
> 
>> 
>>   See our I-D on lifecycle.  It addresses this issue squarely.
> 
> The problem is that RedHat went ahead and disabled support for SHASHA1
> (in the default configuration). That results in systems that
> violate the current DNSSEC standards. It seems some people would like to
> change the standards in such way that RedHat is no longer violating them.
> 
> Regarding draft-crocker-dnsop-dnssec-algorithm-lifecycle I have two
> questions:
> 1) Do we expect to delay draft-ietf-dnsop-must-not-sha1 until after
>   the lifecycle has been accepted and published?
> 2) The intended status of the lifecycle draft is informational. Do we
>   expect that the draft will have a big effect on the current discussion?
>

v2.35.0 | Report a Bug | By Email | System Status