Re: DS Algorithm selection and SHA1 deprecation

[Wes Hardaker <hardaker@tislabs.com>]

>>>>> On Tue, 6 Dec 2005 15:23:38 -0500, Andrew Sullivan <andrew@ca.afilias.info> said:

>> Is SHA-1 better than no understandable DS 
>> records?  (That's the question an operator of a 
>> resolver needs to ask themself.)

Andrew> That was exactly my worry when I read the previous draft, and
Andrew> I think this one has enough wiggle room in it to allow the
Andrew> operator to make the right choice (yet still suggests really
Andrew> strongly that SHA-1 is on the whole probably better to leave
Andrew> behind).

Which was precisely the goal of the current text: make sure operators
can select a secure solution but not mandate that they do so.
Capability is required, forced policy is not.

-- 
Wes Hardaker
Sparta, Inc.

--
to unsubscribe send a message to namedroppers-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>