Subject: Re: [dnsext] [Technical Errata Reported] RFC6944 (4932)

From: "Rose, Scott" <[email-masked]>
Date: Mon, 13 Feb 2017 11:42:54 -0500

A reference to RFC 6944 to the whole registry, or the entry for RSA/MD5? 
  There is a ref for the whole table, but not the entry. If this a 
proposed change to the entry, I agree with the change.

Scott

On 12 Feb 2017, at 8:47, RFC Errata System wrote:

> The following errata report has been submitted for RFC6944,
> "Applicability Statement: DNS Security (DNSSEC) DNSKEY Algorithm 
> Implementation Status".
>
> --------------------------------------
> You may review the report below and at:
> http://www.rfc-editor.org/errata_search.php?rfc=6944&eid=4932
>
> --------------------------------------
> Type: Technical
> Reported by: Petr Spacek <[email-masked]>
>
> Section: 3
>
> Original Text
> -------------
>    This document lists the implementation status of cryptographic
>    algorithms used with DNSSEC.  These algorithms are maintained in an
>    IANA registry at 
> http://www.iana.org/assignments/dns-sec-alg-numbers.
>    Because this document establishes the implementation status of 
> every
>    algorithm, it has been listed as a reference for the registry 
> itself.
>
> Corrected Text
> --------------
>    This document lists the implementation status of cryptographic
>    algorithms used with DNSSEC.  These algorithms are maintained in an
>    IANA registry at 
> http://www.iana.org/assignments/dns-sec-alg-numbers.
>    Because this document establishes the implementation status of 
> every
>    algorithm, it has been listed as a reference for the registry 
> itself.
>
>    Given significance of status change of RSAMD5 algorithm, a 
> reference
>    to this RFC should be added to the registry.
>
> Notes
> -----
> "RSAMD5 has an implementation status of Must Not Implement because of 
> known weaknesses in MD5."
>
> This is very important. An additional reference would lower likelihood 
> that DNS Implementors will overlook the important piece of 
> information.
>
> Instructions:
> -------------
> This erratum is currently posted as "Reported". If necessary, please
> use "Reply All" to discuss whether it should be verified or
> rejected. When a decision is reached, the verifying party
> can log in to change the status and edit the report, if necessary.
>
> --------------------------------------
> RFC6944 (draft-ietf-dnsext-dnssec-algo-imp-status-04)
> --------------------------------------
> Title               : Applicability Statement: DNS Security (DNSSEC) 
> DNSKEY Algorithm Implementation Status
> Publication Date    : April 2013
> Author(s)           : S. Rose
> Category            : PROPOSED STANDARD
> Source              : DNS Extensions
> Area                : Internet
> Stream              : IETF
> Verifying Party     : IESG

==================================
Scott Rose, NIST
[email-masked]
ph: +1-301-975-8439
Google Voice: +1-571-249-3671

---

From: Petr Špaček <[email-masked]>
Date: Mon, 13 Feb 2017 22:13:57 +0100

The reference right in the entry would be helpful. I'm sorry for not
being clear.

Petr Špaček  @  CZ.NIC

On 02/13/2017 05:42 PM, Rose, Scott wrote:
>>    IANA registry at http://www.iana.org/assignments/dns-sec-alg-numbers.
>>    Because this document establishes the implementation status of every
>>    algorithm, it has been listed as a reference for the registry itself.
>>
>> Corrected Text
>> --------------
>>    IANA registry at http://www.iana.org/assignments/dns-sec-alg-numbers.
>>    Because this document establishes the implementation status of every
>>    algorithm, it has been listed as a reference for the registry itself.
>>
>>    Given significance of status change of RSAMD5 algorithm, a reference
>> that DNS Implementors will overlook the important piece of information.
>>
>> Instructions:
>> -------------

---

From: RFC Errata System <[email-masked]>
Date: Sun, 12 Feb 2017 05:47:02 -0800 (PST)

The following errata report has been submitted for RFC6944,
"Applicability Statement: DNS Security (DNSSEC) DNSKEY Algorithm Implementation Status".

Section: 3

Original Text
-------------

Corrected Text
--------------

Notes
-----
"RSAMD5 has an implementation status of Must Not Implement because of known weaknesses in MD5."

This is very important. An additional reference would lower likelihood that DNS Implementors will overlook the important piece of information.

Instructions:
-------------

Title               : Applicability Statement: DNS Security (DNSSEC) DNSKEY Algorithm Implementation Status