Re: [secdir] review of draft-ietf-dnsext-dnssec-gost-05

[Andrew Sullivan <[e-mail]>]

On Fri, Jan 08, 2010 at 09:07:24AM -0500, Stephen Kent wrote:
>
> For S/MIME and OPGP there is a requirement that, ultimately, the  
> receiver has some way to verify the cert associated with the sender.  
> However, it is common for senders to sign messages that are send to  
> mailing lists where the sender has no way of knowing what algorithms all 
> the receivers support. So, your analysis for this case is off the mark. 

This is a good point.  Thanks.

> Rather it makes sense to have a very limited number of algorithm suites 
> that MUST (or SHOULD) be implemented. My recommendation is to limit 
> mandated (MUST or SHOULD) support to just two: current and next.

Hrm.  Well, we already violate this recommendation, I think, but I
take your point.

> BTW, we have had this discussion in SIDR, where the RPKI has a similar 
> global scope and where Vasily had made a similar request for recognition 
> of GOST algorithms. So far, that WG has said no, for the reasons I cited 
> in my comments and above. The current plan there is to go with the two 
> suite model I described above.

Ok.  Thanks for this; it's useful feedback.

Best,

A

-- 
Andrew Sullivan
[e-mail]
Shinkuro, Inc.