Re: [DNSOP] Call for Adoption draft-wouters-sury-dnsop-algorithm-update

"Paul Hoffman" <> Tue, 28 February 2017 21:45 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 49FD51296B4 for <>; Tue, 28 Feb 2017 13:45:10 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.9
X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham autolearn_force=no
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id rlxE8i4sB_3q for <>; Tue, 28 Feb 2017 13:45:08 -0800 (PST)
Received: from (Opus1.Proper.COM []) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id C29B8129537 for <>; Tue, 28 Feb 2017 13:45:08 -0800 (PST)
Received: from [] ( []) (authenticated bits=0) by (8.15.2/8.14.9) with ESMTPSA id v1SLj5gF020172 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO) for <>; Tue, 28 Feb 2017 14:45:06 -0700 (MST) (envelope-from
X-Authentication-Warning: Host [] claimed to be []
From: Paul Hoffman <>
To: dnsop <>
Date: Tue, 28 Feb 2017 13:45:06 -0800
Message-ID: <>
In-Reply-To: <>
References: <> <> <>
MIME-Version: 1.0
Content-Type: text/plain; format="flowed"
X-Mailer: MailMate (1.9.6r5347)
Archived-At: <>
Subject: Re: [DNSOP] Call for Adoption draft-wouters-sury-dnsop-algorithm-update
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: IETF DNSOP WG mailing list <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Tue, 28 Feb 2017 21:45:10 -0000

The recommendations in the document are completely unclear if it is 
talking about:

- what should be in signer implementations
- what should be in validator implementations
- what someone who is starting to sign today SHOULD/MUST use
- what someone who is already signing SHOULD/MUST use

I think those four lists are probably different. Before the document is 
picked up by the WG, it would be good if it made clear which lists it is 

My personal feeling is that if we do the third, we should say MUST NOT 
with any SHA1 algorithm because they're going to get nailed in the 
future by people who refuse to validate it. If we do the fourth, I would 
say SHOULD NOT use now and SHOULD change within two years (or some moral 
equivalent of that).

--Paul Hoffman