Re: [DNSOP] One more bit of Whiskey Tango Foxtrot on key lengths...
Stephane Bortzmeyer <bortzmeyer@nic.fr> Fri, 28 March 2014 08:35 UTC
Return-Path: <bortzmeyer@nic.fr>
X-Original-To: dnsop@ietfa.amsl.com
Delivered-To: dnsop@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id ED7051A01F0 for <dnsop@ietfa.amsl.com>; Fri, 28 Mar 2014 01:35:25 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.56
X-Spam-Level:
X-Spam-Status: No, score=-1.56 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HELO_EQ_FR=0.35, T_RP_MATCHES_RCVD=-0.01] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8CB4dr31K_eA for <dnsop@ietfa.amsl.com>; Fri, 28 Mar 2014 01:35:24 -0700 (PDT)
Received: from mx4.nic.fr (mx4.nic.fr [IPv6:2001:67c:2218:2::4:12]) by ietfa.amsl.com (Postfix) with ESMTP id 4EAE61A049A for <dnsop@ietf.org>; Fri, 28 Mar 2014 01:35:24 -0700 (PDT)
Received: from mx4.nic.fr (localhost [127.0.0.1]) by mx4.nic.fr (Postfix) with SMTP id 93744280289; Fri, 28 Mar 2014 09:35:21 +0100 (CET)
Received: from relay1.nic.fr (relay1.nic.fr [192.134.4.162]) by mx4.nic.fr (Postfix) with ESMTP id 8EC58280230; Fri, 28 Mar 2014 09:35:21 +0100 (CET)
Received: from bortzmeyer.nic.fr (unknown [IPv6:2001:67c:1348:7::86:133]) by relay1.nic.fr (Postfix) with ESMTP id 829374C0086; Fri, 28 Mar 2014 09:34:51 +0100 (CET)
Date: Fri, 28 Mar 2014 09:34:51 +0100
From: Stephane Bortzmeyer <bortzmeyer@nic.fr>
To: Nicholas Weaver <nweaver@icsi.berkeley.edu>
Message-ID: <20140328083451.GA2699@nic.fr>
References: <596FB4BA-D567-40B5-B48B-624E58435800@icsi.berkeley.edu>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <596FB4BA-D567-40B5-B48B-624E58435800@icsi.berkeley.edu>
X-Operating-System: Debian GNU/Linux 7.4
X-Kernel: Linux 3.2.0-4-686-pae i686
Organization: NIC France
X-URL: http://www.nic.fr/
User-Agent: Mutt/1.5.21 (2010-09-15)
Archived-At: http://mailarchive.ietf.org/arch/msg/dnsop/x7cZB5xgzjiQRZ0CPwvb8fpR4u4
Cc: dnsop WG <dnsop@ietf.org>
Subject: Re: [DNSOP] One more bit of Whiskey Tango Foxtrot on key lengths...
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/dnsop/>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 28 Mar 2014 08:35:26 -0000
On Thu, Mar 27, 2014 at 01:15:00PM -0700, Nicholas Weaver <nweaver@icsi.berkeley.edu> wrote a message of 75 lines which said: > But fixing this going forward requires a 1-line change in the ZSK > script: I have nothing against longer keys but this sort of sentences ("DNSSEC is simple, anyone can do it in five minutes") is a sure way to inflame me. It is not sufficient to change the script, you also have to search if it can break things later. A typical example would be the larger response to the DNSKEY query. If changing the key size make it larger than the MTU, it _may_ create problems.
- [DNSOP] One more bit of Whiskey Tango Foxtrot on … Nicholas Weaver
- Re: [DNSOP] One more bit of Whiskey Tango Foxtrot… Stephane Bortzmeyer
- Re: [DNSOP] One more bit of Whiskey Tango Foxtrot… Nicholas Weaver