Re: private algorithms and the DS record

[Samuel Weiler <weiler@tislabs.com>]

On Wed, 22 Dec 2004, David Blacka wrote:

> 1) DS records are modified to contain the private algorithm name,
> allowing the validator algorithm to work the same for public and private
> algorithms, or

As before, I want to avoid this.

> 2) The need and algorithm for fetching the private algorithm name from
> the DNSKEY in a safe manner is documented somewhere (another RFC or
> additional text), or

Excellent choice.  Good catch re: the possible attack if just the
keyid, rather than the hash of the DNSKEY, is compared to the DS --
that needs to be documented.  I'm increasingly fond of a "private
algorithm" doc, but an RFC-Editor note seems practical.  This isn't a
big deal.

> 3) private algorithms are deprecated, or

I'd prefer to leave them in, providing some space for future
experimentation, but I wouldn't object to deprecating them.

> 4) everyone else decides that the current text is clear enough, there is
> no need to change anything, we are fairly sure that future
> implementations of private algorithm support will work just fine, thank
> you very much.

2 and 3 seem like better choices.

-- Sam

--
to unsubscribe send a message to namedroppers-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>