From nobody Sun Nov 22 01:53:37 2020 Return-Path: X-Original-To: dnsext@ietfa.amsl.com Delivered-To: dnsext@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C933C3A1345 for ; Sun, 22 Nov 2020 01:53:35 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cFesDO5L9KpI for ; Sun, 22 Nov 2020 01:53:34 -0800 (PST) Received: from rfc-editor.org (rfc-editor.org [4.31.198.49]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A4A773A1343 for ; Sun, 22 Nov 2020 01:53:34 -0800 (PST) Received: by rfc-editor.org (Postfix, from userid 30) id 34296F40760; Sun, 22 Nov 2020 01:53:16 -0800 (PST) To: paul.hoffman@vpnc.org, wouter@nlnetlabs.nl, ek.ietf@gmail.com, evyncke@cisco.com, ogud@ogud.com, ajs@anvilwalrusden.com X-PHP-Originating-Script: 30:errata_mail_lib.php From: RFC Errata System Cc: m.bencivenga97@gmail.com, dnsext@ietf.org, rfc-editor@rfc-editor.org Content-Type: text/plain; charset=UTF-8 Message-Id: <20201122095316.34296F40760@rfc-editor.org> Date: Sun, 22 Nov 2020 01:53:16 -0800 (PST) Archived-At: Subject: [dnsext] [Technical Errata Reported] RFC6605 (6341) X-BeenThere: dnsext@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Extensions working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 22 Nov 2020 09:53:36 -0000 The following errata report has been submitted for RFC6605, "Elliptic Curve Digital Signature Algorithm (DSA) for DNSSEC". -------------------------------------- You may review the report below and at: https://www.rfc-editor.org/errata/eid6341 -------------------------------------- Type: Technical Reported by: Mattia Bencivenga Section: 1 Original Text ------------- For example, in a signature that uses RSA with 2048-bit keys and SHA-256, the signing portion is significantly weaker than the hash portion, whereas the two algorithms here are balanced. Corrected Text -------------- For example, in a signature that uses RSA with 2048-bit keys and SHA-256, the hash portion is significantly weaker than the signing portion, whereas the two algorithms here are balanced. Notes ----- The signing portion should be RSA with 2048 bits so, the overall security is 1024 bits while the hash portion is SHA-256 that has an overall security of 128 bits. Therefore the hash portion is weaker than the signing portion. Instructions: ------------- This erratum is currently posted as "Reported". If necessary, please use "Reply All" to discuss whether it should be verified or rejected. When a decision is reached, the verifying party can log in to change the status and edit the report, if necessary. -------------------------------------- RFC6605 (draft-ietf-dnsext-ecdsa-07) -------------------------------------- Title : Elliptic Curve Digital Signature Algorithm (DSA) for DNSSEC Publication Date : April 2012 Author(s) : P. Hoffman, W.C.A. Wijngaards Category : PROPOSED STANDARD Source : DNS Extensions Area : Internet Stream : IETF Verifying Party : IESG From nobody Sun Nov 22 09:57:05 2020 Return-Path: X-Original-To: dnsext@ietfa.amsl.com Delivered-To: dnsext@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 73CE83A0317 for ; Sun, 22 Nov 2020 09:57:02 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.401 X-Spam-Level: X-Spam-Status: No, score=0.401 tagged_above=-999 required=5 tests=[KHOP_HELO_FCRDNS=0.399, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VsPrdGI3uC5Y for ; Sun, 22 Nov 2020 09:57:01 -0800 (PST) Received: from mail.proper.com (Opus1.Proper.COM [207.182.41.91]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4649C3A02D0 for ; Sun, 22 Nov 2020 09:57:01 -0800 (PST) Received: from [10.10.10.227] (76-209-242-70.lightspeed.mtryca.sbcglobal.net [76.209.242.70]) (authenticated bits=0) by mail.proper.com (8.15.2/8.15.2) with ESMTPSA id 0AMHsCmu016404 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Sun, 22 Nov 2020 10:54:12 -0700 (MST) (envelope-from paul.hoffman@vpnc.org) X-Authentication-Warning: mail.proper.com: Host 76-209-242-70.lightspeed.mtryca.sbcglobal.net [76.209.242.70] claimed to be [10.10.10.227] From: "Paul Hoffman" To: "Mattia Bencivenga" Cc: "RFC Errata System" , wouter@nlnetlabs.nl, ek.ietf@gmail.com, evyncke@cisco.com, ogud@ogud.com, ajs@anvilwalrusden.com, dnsext@ietf.org Date: Sun, 22 Nov 2020 09:56:52 -0800 X-Mailer: MailMate (1.13.2r5673) Message-ID: <91454A04-FE3D-4DE3-8D7D-B849CDDB9BB8@vpnc.org> In-Reply-To: References: <20201122095316.34296F40760@rfc-editor.org> MIME-Version: 1.0 Content-Type: text/plain; format=flowed Archived-At: Subject: Re: [dnsext] [Technical Errata Reported] RFC6605 (6341) X-BeenThere: dnsext@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Extensions working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 22 Nov 2020 17:57:02 -0000 On 22 Nov 2020, at 1:58, Mattia Bencivenga wrote: > Do not verify this report, just reject it. The original version is > correct. Agree. In fact, if it can just be removed from the errata dataset, that would be best. --Paul Hoffman From nobody Mon Nov 23 00:31:34 2020 Return-Path: X-Original-To: dnsext@ietfa.amsl.com Delivered-To: dnsext@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1E2973A172D; Mon, 23 Nov 2020 00:31:28 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0 X-Spam-Level: X-Spam-Status: No, score=0 tagged_above=-999 required=5 tests=[SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NNETk1II11wr; Mon, 23 Nov 2020 00:31:26 -0800 (PST) Received: from rfc-editor.org (rfc-editor.org [4.31.198.49]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 87E1B3A172B; Mon, 23 Nov 2020 00:31:26 -0800 (PST) Received: by rfc-editor.org (Postfix, from userid 30) id 26D2FF40726; Mon, 23 Nov 2020 00:31:25 -0800 (PST) To: m.bencivenga97@gmail.com, paul.hoffman@vpnc.org, wouter@nlnetlabs.nl X-PHP-Originating-Script: 30:errata_mail_lib.php From: RFC Errata System Cc: evyncke@cisco.com, iesg@ietf.org, dnsext@ietf.org, rfc-editor@rfc-editor.org Content-Type: text/plain; charset=UTF-8 Message-Id: <20201123083125.26D2FF40726@rfc-editor.org> Date: Mon, 23 Nov 2020 00:31:25 -0800 (PST) Archived-At: Subject: [dnsext] [Errata Rejected] RFC6605 (6341) X-BeenThere: dnsext@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Extensions working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 23 Nov 2020 08:31:28 -0000 The following errata report has been rejected for RFC6605, "Elliptic Curve Digital Signature Algorithm (DSA) for DNSSEC". -------------------------------------- You may review the report below and at: https://www.rfc-editor.org/errata/eid6341 -------------------------------------- Status: Rejected Type: Technical Reported by: Mattia Bencivenga Date Reported: 2020-11-22 Rejected by: Eric Vyncke (IESG) Section: 1 Original Text ------------- For example, in a signature that uses RSA with 2048-bit keys and SHA-256, the signing portion is significantly weaker than the hash portion, whereas the two algorithms here are balanced. Corrected Text -------------- For example, in a signature that uses RSA with 2048-bit keys and SHA-256, the hash portion is significantly weaker than the signing portion, whereas the two algorithms here are balanced. Notes ----- The signing portion should be RSA with 2048 bits so, the overall security is 1024 bits while the hash portion is SHA-256 that has an overall security of 128 bits. Therefore the hash portion is weaker than the signing portion. ----- Below added by Eric Vyncke ----- Based on Paul Hoffman (author) and Mattia Bencivenga (submitter) answers on DNSEXT mailing list. RFC Editor note: please even remove completely this errata. --VERIFIER NOTES-- Based on Paul Hoffman (author) and Mattia Bencivenga (submitter) answers on DNSEXT mailing list. RFC Editor note: please even remove completely this errata. -------------------------------------- RFC6605 (draft-ietf-dnsext-ecdsa-07) -------------------------------------- Title : Elliptic Curve Digital Signature Algorithm (DSA) for DNSSEC Publication Date : April 2012 Author(s) : P. Hoffman, W.C.A. Wijngaards Category : PROPOSED STANDARD Source : DNS Extensions Area : Internet Stream : IETF Verifying Party : IESG From nobody Tue Nov 24 05:55:43 2020 Return-Path: X-Original-To: dnsext@ietfa.amsl.com Delivered-To: dnsext@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3252C3A0E09 for ; Tue, 24 Nov 2020 05:55:41 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.001 X-Spam-Level: X-Spam-Status: No, score=0.001 tagged_above=-999 required=5 tests=[SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wFKkb-pa5RNY for ; Tue, 24 Nov 2020 05:55:37 -0800 (PST) Received: from mail.amsl.com (c8a.amsl.com [4.31.198.40]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9A35C3A0E03 for ; Tue, 24 Nov 2020 05:55:36 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by c8a.amsl.com (Postfix) with ESMTP id 171103C3716; Tue, 24 Nov 2020 05:55:36 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from c8a.amsl.com ([127.0.0.1]) by localhost (c8a.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id enON8nQIGrTm; Tue, 24 Nov 2020 05:55:35 -0800 (PST) Received: from [192.168.68.107] (pool-173-48-33-241.bstnma.fios.verizon.net [173.48.33.241]) by c8a.amsl.com (Postfix) with ESMTPA id 353853C3717; Tue, 24 Nov 2020 05:55:35 -0800 (PST) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.6\)) From: Megan Ferguson In-Reply-To: <91454A04-FE3D-4DE3-8D7D-B849CDDB9BB8@vpnc.org> Date: Tue, 24 Nov 2020 08:55:35 -0500 Cc: dnsext@ietf.org, Andrew Sullivan , wouter@nlnetlabs.nl, ek.ietf@gmail.com, "Eric Vyncke (evyncke)" , ogud@ogud.com, RFC System Content-Transfer-Encoding: quoted-printable Message-Id: References: <20201122095316.34296F40760@rfc-editor.org> <91454A04-FE3D-4DE3-8D7D-B849CDDB9BB8@vpnc.org> To: Paul Hoffman , Mattia Bencivenga X-Mailer: Apple Mail (2.1878.6) Archived-At: Subject: Re: [dnsext] [Technical Errata Reported] RFC6605 (6341) X-BeenThere: dnsext@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Extensions working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 24 Nov 2020 13:55:41 -0000 Hi Paul and Mattia, We have deleted this errata report as requested. Thank you. RFC Editor/mf On Nov 22, 2020, at 12:56 PM, Paul Hoffman = wrote: > On 22 Nov 2020, at 1:58, Mattia Bencivenga wrote: >=20 >> Do not verify this report, just reject it. The original version is = correct. >=20 > Agree. In fact, if it can just be removed from the errata dataset, = that would be best. >=20 > --Paul Hoffman >=20