[secdir] SHA512 in draft-dnsext-dnssec-rsa-sha2

[Jelte Jansen <[e-mail]>]

Hi,

I am the editor of http://tools.ietf.org/html/draft-ietf-dnsext-dnssec-rsasha256-14

which has seen its share of trouble, but is finally nearing WGLC.

This draft defines the use of RSA/SHA256 and RSA/SHA512 with DNSSEC.

We were about to call it, when Alfred Hoenes mentioned to me that the IESG will 
probably raise an issue about the use of SHA512 in this draft.

For practical reasons, it does not specify keys larger than 4096 bits to use 
with RSA/SHA-512, while normally, much larger keysizes are chosen for use with 
the bigger digest values. So he suspects that this definition should be removed 
or reduced to SHA/384.

So my question is, do you as the security directorate think the same, and should 
I change this before going into last call?

Thanks,

Jelte Jansen