Subject: RSA/SHA1

From: "Donald E. Eastlake 3rd" <[email-masked]>
Date: Fri, 25 Aug 2000 08:34:28 -0400

The initial RSA/SHA-1 draft is out.  I welcome comments.  As presently
drafted it completely obsoletes RFC 2537 which blows away the RSA/MD5
stuff.  I think what we are pretty much saying here is that we don't
trust MD5 enough into the future for sensitive security like high
level DNS zones.

I think this applies even to non-DNS uses.  For example, if someone is
using DNS keys for email security, while MD5 is probably fine for most
mail, for sensitive messages, you would want to use SHA1.  And since
the computation required is not much more and you want to avoid the
possibiity of downgrade attacks, you might as well always use SHA1.
Pretty much the same considerations as for DNSSEC...

Thanks,
Donald

Message-Id:  <[email-masked]>
To:  IETF-Announce: ;
Cc:  [email-masked]
From:  [email-masked]
Subject:  I-D ACTION:draft-ietf-dnsext-rsa-00.txt
Date:  Fri, 25 Aug 2000 06:43:20 -0400

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the DNS Extensions Working Group of the IETF.

	Title		: RSA/SHA-1 SIGs and RSA KEYs in the Domain Name System 
                         (DNS)
	Author(s)	: D. Eastlake 3rd
	Filename	: draft-ietf-dnsext-rsa-00.txt
	Pages		: 8
	Date		: 24-Aug-00
	
Since the adoption of a Proposed Standard for RSA signatures in the
DNS [RFC 2537], advances in hashing have been made.  A new DNS
signature algorithm is defined to make these advances available in
SIG resource records (RRs).  The use of the previously specified
weaker mechanism is deprecated.  The algorithm number of the RSA KEY
RR is changed to correspond to this new SIG algorithm.  No other
changes are made to DNS security.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-dnsext-rsa-00.txt

Internet-Drafts are also available by anonymous FTP. Login with the username
"anonymous" and a password of your e-mail address. After logging in,
type "cd internet-drafts" and then
	"get draft-ietf-dnsext-rsa-00.txt".

A list of Internet-Drafts directories can be found in
http://www.ietf.org/shadow.html 
or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.