Re: [keyassure] Opening issue #21: "Need to specify which crypto

[Andrew Sullivan <[e-mail]>]

On Fri, Mar 04, 2011 at 06:36:42AM -0800, Paul Hoffman wrote:
> The way I read Warren's proposal, we get exactly what you want. There  
> are two different mandatory code points defined for two different  
> hashes, so we are sure that the deployed code will be able to handle  
> hash agility. We don't care which algorithm people use in practice  
> because they are both mandatory, so there is no spitting up or dying.
>
> Does that work for you?

Sort of.  Maybe it's recent exposure to brain-dead programmers, but
I've encountered the situation where a spec says, "There are now two;
there might be more in the future."  What the programmer does is go
away and write an implementation that has the two, and puts a comment
in the code that says, "Future code changes may need to be here,
because there might be new things defined."  Or something like that.

As I say, I can't think of much to say about this that's different, so
maybe I'm fretting over nothing.  But algorithm maintenance is already
a headache for DNSSEC, and we've only started deployment.

A

-- 
Andrew Sullivan
[e-mail]
Shinkuro, Inc.