Re: [secdir] SHA512 in draft-dnsext-dnssec-rsa-sha2

[Paul Hoffman <[e-mail]>]

At 11:14 AM -0400 6/18/09, Andrew Sullivan wrote:
>On Thu, Jun 18, 2009 at 07:06:14AM -0700, Eric Rescorla wrote:
>>
>> Well, I would ask why you're specifying either 384 or 512.
>>
>> SHA-256 would have to be weakened *very* badly before it would
>> be necessary to move up, at which point what makes you think
>> that SHA-384/512 will be strong?
>
>The point of this is just to get things done.  It has taken a
>remarkably long time to get this SHA-2 draft through the WG -- the
>current revision is -14, and when we started everyone (including the
>incredibly patient Jelte) thought this was a quick housekeeping
>problem.  The draft specifies 256, but while we were at it we thought
>512 might be a good idea too, so that it'd be done in case we needed
>it later.
>
>Does that change your response?

In the security area, we have discovered that if something security-related is defined, people will use it even if it is stupid. "That's a bigger number, so it will be safer" is a common theme, but so is "they would not have specified that algorithm unless they wanted everyone to implement it".

Thus, I think Eric's question still stands. Your response in the document could be "we define this because of the IETF overhead of doing so, not because we want you to use it now", but I suspect that will only reduce the number of people who use the signature algorithm for absolutely no good reason by less than 50%.