Subject: [secdir] secdir review of draft-ietf-dnsext-5395bis

From: Samuel Weiler <[email-masked]>
Date: Wed, 5 Jan 2011 05:56:56 -0500 (EST)

I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the
IESG.  These comments were written primarily for the benefit of the
security area directors.  Document editors and WG chairs should treat
these comments just like any other last call comments.

5395 made some pretty big changes in how DNS RR types are assigned.
This update is trivial by comparison.  It was mainly triggered by the 
change in the DNSEXT WG mailing list name, which had been hard coded 
into 5395.  Other changes are editorial (e.g. removing the list of 
differences between 5395 and 2929).

The doc has no particular security impact.

I have no objections.

-- Sam

---

From: Samuel Weiler <[email-masked]>
Date: Thu, 6 Jan 2011 13:07:01 -0500 (EST)

Looking at David Harrington's DISCUSS, I'll let someone else address 
the substance, but I observe that there are basically no changes in 
these sections from RFC5393.

-- Sam

On Wed, 5 Jan 2011, Samuel Weiler wrote:

> This update is trivial by comparison.  It was mainly triggered by the change 
> in the DNSEXT WG mailing list name, which had been hard coded into 5395. 
> Other changes are editorial (e.g. removing the list of differences between 
> 5395 and 2929).
>

---

From: Tina Tsou <[email-masked]>
Date: Thu, 06 Jan 2011 11:48:28 -0800

I have no comment to this draft as it adds more cipher algorithm, which is
the right trend within security domain.  As we know, MD5 and SHA-1 was
cracked with the analytical attack by Wang Xiaoyun in Shangdong University.
So there must be strong algorithm to address these security holes.

Best Regards,
Tina TSOU
http://tinatsou.weebly.com/contact.html