[DNSOP] Re: [regext] Acceptance of DNSSEC Parameters in EPP

[Joe Abley <[e-mail]>]

Hi Jim!

On 14 Oct 2026, at 21:01, Jim Reid <[e-mail]> wrote:

> On 14 Oct 2026, at 19:08, Joe Abley <jabley=[e-mail]> wrote:

> 
>> I'll happily collect feedback from anywhere, of course :-)
> 
> Here's mine Joe.
> 
> It would be a Very Good Thing if there was a concise doc which said which crypto algorithms were good/bad/ugly/obsolete for DNSSEC. I like that idea - a lot. It's sort of done in IANA's registry but could be clearer.* A doc which points people at https://www.iana.org/assignments/dns-sec-alg-numbers, the One True Registry of DNSSEC code points, would have value beyond EPP and RPP. The EPP and RPP specs could just reference that doc - it it existed.

My starting point is that RFC 9904 made the ds-rr-types and dns-sec-alg-numbers registrries clearer in the way you are hoping for by adding columns to indicate requirements levels for various purposes. It's a good document, and I think that's the document you are asking for -- and it already exists! It must be your birthday. Future developments get to modify the requirements in the registry so that we are not held captive to a document as a snapshot in time. It's all so beautiful.

> IMO development of that doc belongs in dnsop, not regext. After all, dnsop is pretty much the gatekeeper for DNSSEC algorithm code points. If another WG intervenes, it could create confusion. It might lead to inconsistencies and/or needless duplication if there's no longer exactly one registry for these code points.

Fully agree, and RFC 9904 was a product of dnsop, I think.

> What's the justification for doing that work in regext and not dnsop?

None. That work is already done. My doc simjply applying the legacy of that work to EPP, which I think makes it on-topic for regext but worthy of mention here.


Joe