Re: [secdir] review of draft-ietf-dnsext-dnssec-gost-05

[Nicolas Williams <[e-mail]>]

On Tue, Feb 09, 2010 at 04:11:56PM -0500, Stephen Kent wrote:
> >I do agree that MUST set of algorithms should be very narrow and 
> >limited generally speaking to those algorithms by which root zone is 
> >signed.
> 
> I'm glad we agree on this. Since SHOULD is only a slightly-diminished 
> form of MUST, ...

I'd add that if you "do agree that MUST set of algorithms should be very
narrow" then it follows...

...that you can't allow any nation to dictate that some sub-set of
algorithms must be added to the MUST set, because the moment you do all
comers will demand their alg suite be added and you no longer have a
"narrow" set of MUST-implement algorithms.

(Yes, I'm merely re-stating what has already been said.  But perhaps
this formulation will make the point clearer.)

Therefore the IETF policy seems quite right to me.  GOST can only become
a MUST- or SHOULD-implement algorithm only if we need one more algorithm
_and_ GOST is the best candidate.

That said...

> >Maybe this is the way the DNS system will develop, but now I think 
> >that the some effort to keep the DNS system united is justified.
> 
> Unified is a goal we both agree upon, but mandated support for 
> national algorithms is NOT a unifying principle, it is a Balkanizing 
> principle (if you'll pardon the term).

+1

...note too that I don't see why Russia couldn't make GOST support a
requirement for resolvers and DNS servers distributed in Russia.  They'd
want to sign their zones (at least top level ones) with RSA in addition
to GOST, but the burden of doing so would be minimal.

Any nation could take the approach of legislating MUST-implement sets
within their borders.

Note that failure to sign all the way to leaf zones with MUST-implement
algorithms is, effectively, a way of dividing the namespace, but at
least that would apply only to DNSSEC and not plain DNS.  Note too that
having national algorithms in the MUST-implement set wouldn't guarantee
that the root zone would be signed with them.  The only way to do that
would be through political agreements with, say, ICANN, or forking the
roots.

All of which leads me to this conclusion: adding national algorithms to
the DNSSEC MUST-implement list cannot achieve a political goal that
DNSSEC deployments use that algorithm.  So what would we get in exchange
for burdening implementors?  As far as I can see: nothing.

Nico
--