Since I was not present at recent hash related government sponsored
meetings can I get a confirmation that SHA256 is considered to be
sufficiently secure and is now recommended where SHA1 previously was
to be used?

Also will the new hash algorithm be developed and if so when should we
expect it? Will it be 160-bit or at minimum 256-bit like SHA256?

On Thu, 17 Nov 2005, Scott Rose wrote:

> I just finished the draft and I have one comment on Section 3. I don't know
> if the wording "MUST perfer DS records with SHA-256..." is necessary. It is
> also rather vague for validator implementors - what happens when the SHA-256
> DS RR is invalid, but there is a valid SHA-1? Is the chain still valid? I
> think the preference language isn't necessary (local policy ) since most
> developers know SHA-256 is stronger than SHA-1.
>
> Also, it might be helpful for readers to include a simple table in the IANA
> considerations section detailing the algorithms:
>
> VALUE Algorithm Status
> 0 Reserved -
> 1 SHA-1 MANDATORY(1)
> 2 SHA-256 MANDATORY
> 3-255 Unassigned -
>
> (1) SHA-1 is still mandatory to implement and deploy for a period following
> the publication of this draft to RFC status. This is necessary for a period
> of backwards compatibility until SHA-256 is more widely deployed. See
> section 4.
>
> -------------
> Or something similar. The note may not be necessary.
>
> Scott
> ****************************************
> Scott Rose
> Adv. Network Tech. Div., NIST
> +1 301-975-8439
>
> https://www-x.antd.nist.gov/dnssec/
> ****************************************


--
to unsubscribe send a message to namedroppers-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: