Re: Q2: crypto algorithm requirements for DNSSEC

[Mark.Andrews@isc.org]

> Mark.Andrews@isc.org writes:
> 
> > > There is a difference between "MUST implement" and "MUST use".  We
> > > could always specify "must implement" for two algorithms, but provide
> > > language that suggests that you should use one and should not use the
> > > other.
> > 
> > 	The problem is that if you don't sign with both you can't
> > 	easily withdraw one of them when you need to.  The resolver
> > 	can protect itself if both signatures are there.  It can
> > 	simple choose to ignore one of them.  If they are both not
> > 	there then it doesn't get this choice and you will get dead
> > 	branchs as a result.
> 
> So you re-sign your zone.  You have to re-sign it periodically
> anyways, so what's the big deal?  Why have twice the data and perform
> twice the work on the miniscule chance that one of the algorithms will
> be broken during the time your signatures are valid?

	It's not just re-signing the zone.  It's generating a new key,
	passing it to the parent, waiting for the DS to be published.
	(I would love to see how well Verisign copes with 10% of COM
	trying to get new DS records generated simultaniously)
	It's waiting for the majority of sites to do this before you
	can disable the vulnerable algorithm in your resolvers.  

	If the keys and sigs are already deployed all you need to
	do is disable the algorithm.
 
> >From a security viewpoint, you want the code deployed to allow you to
> quickly move from one algorithm to another -- but that does *NOT* mean
> that you need to use (or WANT to use) both algorithms for all your
> data all the time.
> 
> > 	Manditory to implement also applies to signing.  You havn't
> > 	implemented if you are not using it.
> 
> I completely disagree.  You can implement something but not use it.
> 
> > 	Mark
> 
> -derek
> 
> -- 
>        Derek Atkins
>        Computer and Internet Security Consultant
>        derek@ihtfp.com             www.ihtfp.com
--
Mark Andrews, Internet Software Consortium
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: Mark.Andrews@isc.org

--
to unsubscribe send a message to namedroppers-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>