Re: [keyassure] Opening issue #21: "Need to specify which crypto

[Andrew Sullivan <[e-mail]>]

On Fri, Mar 04, 2011 at 11:51:10PM +1300, Peter Gutmann wrote:
> is finalised all I need to do is plug the algorithm in.  Putting the same
> thing into DANE isn't hard, and makes it easier to deploy future-compatible
> implementations from day one.

I don't see any reason to say specifically, "We'll be moving to _x_ so
you better have a placeholder for it".  That will simply encourage
foolish programmers to write one placeholder spot, and then when SHA-4
or whatever comes along we have a new problem.

The right way to do this is something like the unknown RRTYPE in DNS.
In that case, you have to be able to handle anything you get (within
the valid codepoint range) _even if_ you don't understand it.  By
"handle", I mean, "be able to pass messages; not spit up and die," and
so on.  It does not mean, of course, that you have to be able to do
whatever additional section processing or whatever is required, and
you don't need to be able to do anything useful (if you don't know
what NSEC3 is, you're not going to be able to validate with it).  

I'm not sure how to say something similar in this case, but I think
it's the right sort of framework.

A

-- 
Andrew Sullivan
[e-mail]
Shinkuro, Inc.