Subject: Re: [DNSOP] Last Call: <draft-ietf-dnsop-algorithm-update-05.txt> (Algorithm Implementation Requirements and Usage Guidance for DNSSEC) to Proposed Standard

From: Paul Wouters <[email-masked]>
Date: Sun, 17 Feb 2019 19:13:01 -0500 (EST)

On Fri, 15 Feb 2019, Mats Dufberg wrote:

> The table in section 3.3 ("DS and CDS Algorithms") of the draft states that SHA-1 is "MUST NOT" for "DNSSEC Delegation" but in the narrative text under the table it states "SHA-1 [...] is NOT RECOMMENDED for use in generating new DS and CDS records."
>
> The two statements should be consistent in the final RFC.

Done, thanks for spotting that.

https://tools.ietf.org/rfcdiff?url2=draft-ietf-dnsop-algorithm-update-06.txt

     SHA-1 is still in wide use for DS records, so validators MUST
-   implement validation, but it is NOT RECOMMENDED for use in generating
-   new DS and CDS records.  (See Operational Considerations for caveats
-   when upgrading from SHA-1 to SHA-256 DS Algorithm.)
+   implement validation, but it MUST NOT be used to generate new DS and
+   CDS records.  (See Operational Considerations for caveats when
+   upgrading from SHA-1 to SHA-256 DS Algorithm.)

Paul

---

From: Mats Dufberg <[email-masked]>
Date: Fri, 15 Feb 2019 16:20:26 +0000

Yours,
Mats

---
Mats Dufberg
DNS Specialist, IIS
Mobile: +46 73 065 3899
https://www.iis.se/en/

-----Original Message-----
From: DNSOP <[email-masked]> on behalf of The IESG <[email-masked]>
Reply-To: "[email-masked]" <[email-masked]>
Date: Wednesday, 13 February 2019 at 20:30
To: IETF-Announce <[email-masked]>
Cc: Tim Wicinski <[email-masked]>, "[email-masked]" <[email-masked]>, "[email-masked]" <[email-masked]>, "[email-masked]" <[email-masked]>
Subject: [DNSOP] Last Call: <draft-ietf-dnsop-algorithm-update-05.txt> (Algorithm Implementation Requirements and Usage Guidance for DNSSEC) to Proposed Standard

    The IESG has received a request from the Domain Name System Operations WG
    (dnsop) to consider the following document: - 'Algorithm Implementation
    Requirements and Usage Guidance for DNSSEC'
      <draft-ietf-dnsop-algorithm-update-05.txt> as Proposed Standard
    
    The IESG plans to make a decision in the next few weeks, and solicits final
    comments on this action. Please send substantive comments to the
    [email-masked] mailing lists by 2019-02-27. Exceptionally, comments may be
    sent to [email-masked] instead. In either case, please retain the beginning of
    the Subject line to allow automated sorting.
    
    Abstract

       The DNSSEC protocol makes use of various cryptographic algorithms in
       order to provide authentication of DNS data and proof of non-
       existence.  To ensure interoperability between DNS resolvers and DNS
       authoritative servers, it is necessary to specify a set of algorithm
       implementation requirements and usage guidelines to ensure that there
       is at least one algorithm that all implementations support.  This
       document defines the current algorithm implementation requirements
       and usage guidance for DNSSEC.  This document obsoletes [RFC6944].

    
    The file can be obtained via
    https://datatracker.ietf.org/doc/draft-ietf-dnsop-algorithm-update/
    
    IESG discussion can be tracked via
    https://datatracker.ietf.org/doc/draft-ietf-dnsop-algorithm-update/ballot/

    No IPR declarations have been submitted directly on this I-D.

    
    _______________________________________________
    DNSOP mailing list
    [email-masked]
    https://www.ietf.org/mailman/listinfo/dnsop

---

From: Mats Dufberg <[email-masked]>
Date: Mon, 18 Feb 2019 17:05:29 +0000

If this draft is approved, the new RFC will obsolete RFC 6944. RFC 6944, in turn, updates eight other RFCs. As I interpret it, the new RFC will inherit that role. I think that should be explicitly stated in the new RFC.

Yours,
Mats

---
Mats Dufberg
DNS Specialist, IIS
Mobile: +46 73 065 3899
https://www.iis.se/en/

-----Original Message-----
From: DNSOP <[email-masked]> on behalf of The IESG <[email-masked]>
Reply-To: "[email-masked]" <[email-masked]>
Date: Wednesday, 13 February 2019 at 20:30
To: IETF-Announce <[email-masked]>
Cc: Tim Wicinski <[email-masked]>, "[email-masked]" <[email-masked]>, "[email-masked]" <[email-masked]>, "[email-masked]" <[email-masked]>
Subject: [DNSOP] Last Call: <draft-ietf-dnsop-algorithm-update-05.txt> (Algorithm Implementation Requirements and Usage Guidance for DNSSEC) to Proposed Standard

    
    Abstract

---

From: S Moonesamy <[email-masked]>
Date: Mon, 18 Feb 2019 15:38:26 -0800

Hello,
At 09:05 AM 18-02-2019, Mats Dufberg wrote:
>If this draft is approved, the new RFC will obsolete RFC 6944. RFC 
>6944, in turn, updates eight other RFCs. As I interpret it, the new 
>RFC will inherit that role. I think that should be explicitly stated 
>in the new RFC.

draft-ietf-dnsop-algorithm-update-06 is silent about the last 
paragraph in the Section 1 of RFC 6944.  RFC 6944 is also silent 
about what it is updating in the eight RFCs.  Is this draft proposing 
to obsolete those "Updates" [1]?

Regards,
S. Moonesamy

1. There was a message from the IESG on this mailing list about "Updates".

---

From: Paul Wouters <[email-masked]>
Date: Mon, 18 Feb 2019 18:48:19 -0500 (EST)

On Mon, 18 Feb 2019, S Moonesamy wrote:

>> If this draft is approved, the new RFC will obsolete RFC 6944. RFC 6944, in 
>> turn, updates eight other RFCs. As I interpret it, the new RFC will inherit 
>> that role. I think that should be explicitly stated in the new RFC.
>
> draft-ietf-dnsop-algorithm-update-06 is silent about the last paragraph in 
> the Section 1 of RFC 6944.  RFC 6944 is also silent about what it is updating 
> in the eight RFCs.  Is this draft proposing to obsolete those "Updates" [1]?

See also:

https://www.rfc-editor.org/pipermail/rfc-interest/2019-February/010332.html

It seems that we likely do not need to add Update: clauses for those
entries in 6944.

Paul

---

From: S Moonesamy <[email-masked]>
Date: Mon, 18 Feb 2019 16:25:24 -0800

Hi Paul,
>It seems that we likely do not need to add Update: clauses for those

Thanks for the quick response.  By the way, the draft is 
well-written.  The IESG might have a few comments about the references section.

Regards,
S. Moonesamy