Re: [dnsext] Adopting draft: draft-hoffman-dnssec-ecdsa-04.txt

On 1/5/11 10:39 AM, Chris Thompson wrote:
> On Jan 5 2011, Edward Lewis wrote:
>
>> I'd like to see this stated in DNS terms - i.e., the notion of
>> strength is not one of them.
>>
>> I would suggest that
>>
>> - the authoritative set of the DS record SHOULD include a DS RR for
>> each key that is of the same hash algorithm as is used in the key and
>> MAY have other hashes (and MAY even have only other hashes[1])
>>
>> [1] The parenthetical comment is redundant, put it there for emphasis.
>>
>> - a validator SHOULD prefer the DS record of the same hash algorithm
>> over other hash algorithms for a key.
>
> You mean that a validator should prefer a digest type 1 (SHA-1) DS over
> a type 2 (SHA-256) DS if the key to be validated uses algorithm RSASHA1?
> This directly contradicts the SHOULD in RFC 4509 section 3, and also
> doesn't seem too sensible to me.

Thank you, Chris. I knew that someone had said something about strengths 
in an RFC, but I could not remember where. You nailed it.

That's not to say that we should have equivalent wording in this 
document, just that the "cannot say anything about strength" is a new 
requirement that is not met by earlier standards-track documents from 
this WG.
_______________________________________________
dnsext mailing list
dnsext@ietf.org
https://www.ietf.org/mailman/listinfo/dnsext