Re: [dnsext] about ECDSA

 In your previous mail you wrote:

>  > - my Fedora 16 compiles OpenSSL with no Elliptic Curve support (and
>  >  of course no ECDSA). If someone wants to put some pressure to get
>  >  this fixed, I'll join!
>  
>  This is a compile-time option for OpenSSL.

=> in fact a configure-time option: after this unexpected (:-) test of
the ECDSA support detection, I looked at the .spec file: OpenSSL was
configured with 'no-ec no-ecdh no-ecdsa'...

> If the version of OpenSSL that comes with Fedora 16 doesn't have the
> option, you can download a fresh version of OpenSSL and build it
> locally.

=> I did this and took the opportunity to try the new 1.0.1 version.

>  > - I still have a question about the 256/384 pair: are they
>  >  supposed to be handled as two different algos (as RSASHA1 and
>  >  RSASHA256, or RSASHA256 and RSASHA512) or as the same algo
>  >  with two different "strengths"? Note at the beginning (i.e.,
>  >  when I asked this many months ago) it was only a concern for
>  >  the signer but according to a recent discussion it is concern
>  >  for resolvers too.
>  
>  They are different algorithms with different strengths, so your
>  either/or question doesn't make sense. Similarly, each of the defined
>  SHA-2 variants are also different algorithms and each has a different
>  strength.

=> I'll rephrase the question: does it make sense to use
ECDSAP256SHA256 for ZSKs and ECDSAP384SHA384 for the KSK?

>  > PS: I am not the right person to ask for ECDSA support in
>  > the next distribs (I don't say you shouldn't ask).

=> oops, I should have added "bind9" here.

Thanks

Francis.Dupont@fdupont.fr
_______________________________________________
dnsext mailing list
dnsext@ietf.org
https://www.ietf.org/mailman/listinfo/dnsext