[dnsext] RFC 4509 was Re: Adopting draft: draft-hoffman-dnssec-ecdsa-04.txt

At 10:56 -0800 1/5/11, Paul Hoffman wrote:
>Thank you, Chris. I knew that someone had said something about strengths in
>an RFC, but I could not remember where. You nailed it.
>
>That's not to say that we should have equivalent wording in this document,
>just that the "cannot say anything about strength" is a new requirement that
>is not met by earlier standards-track documents from this WG.

Looking at 4509, the two places "strength" is mentioned is here:

6.2.  SHA-1 vs. SHA-256 Considerations for DS Records

    Users of DNSSEC are encouraged to deploy SHA-256 as soon as software
    implementations allow for it.  SHA-256 is widely believed to be more
    resilient to attack than SHA-1, and confidence in SHA-1's strength is
    being eroded by recently announced attacks....

My comment about needing references applies to that - "recently 
announced attacks" is unsupported by a reference.

                                     ...It is beyond the scope of this
    document to speculate extensively on the cryptographic strength of
    the SHA-256 digest algorithm.

And here the document says strength is beyond the scope.

In section 3:

    ...Validator implementations SHOULD ignore DS RRs containing SHA-1
    digests if DS RRs with SHA-256 digests are present in the DS RRset.

Looking at this, I don't see why this is a good idea if the key is 
RSA/SHA-1 (algorithm 5 or 7).  Well, not a bad idea, but what is 
gained?  If SHA-1 is questionable, why is it more questionable if 
it's the DS hash than if it is the DNSKEY hash?  Isn't the weakest 
link still SHA-1?  (Ignoring the rest of the chain.)
-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis             
NeuStar                    You can leave a voice message at +1-571-434-5468

The 21st Century is 10% complete.
_______________________________________________
dnsext mailing list
dnsext@ietf.org
https://www.ietf.org/mailman/listinfo/dnsext