Re: [DNSOP] [Ext] Call for Adoption: draft-hardaker-dnsop-rfc8624-bis, must-not-sha1, must-not-ecc-gost

[Paul Hoffman <[e-mail]>]

On Apr 30, 2024, at 16:00, Paul Wouters <[e-mail]> wrote:
> 
> On Apr 30, 2024, at 18:42, Paul Hoffman <[e-mail]> wrote:
>> 
>> This cull-because-of-low usage thread incorrectly assumes that the DNS is flat instead of a hierarchy. The last I saw, there are 14 TLDs who use RSASHA1. Advancing this draft as-is means that all of the zones under those TLDs would be completely wiped out as well. Or maybe that's what the WG wants?
> 
> Not wiped out. Being made insecure (versus part of the world only treating them insecure)

Fair point. "Made their efforts to use DNSSEC useless" would have been a better way to say it.

> It’s worth contacting them for timelines of migration away from SHA1, as RFC 8624 is five years old and that already told them to start moving.
> 
> Is that something within the realm of ICANN? Perhaps the DNS Tech Day ?

You ask those questions sounding as if ICANN staff had not already done so.

> Or perhaps a liaison statement from IETF to ICANN ?

Such a statement would be quite a different action than the threat of making all the zones under many TLDs go insecure. This thread is about WG adoption of a draft that would do the latter.

--Paul Hoffman