[Dnssec-deployment] DS digest types 1 vs 2
cet1 at cam.ac.uk
Wed Jul 28 17:35:06 EDT 2010
As we are agonising about the merits of SHA-1 vs SHA-256 in signing
algorithms, what is the general opinion about what digest type(s) to
use in DS records? Just 1 (SHA-1)? Just 2 (SHA-256)? Both (in which
case RFC 4509 section 3 requires that SHA-256-understanding validators
ignore the type 1 DS record).
There is a meta-question here: is it the policy for the parent zone
or that for the child zone that determines this? My own feeling is
that the first is preferable: the child registers a (K)SK with the
parent and the parent decides what DS records to generate. (That's
essentially how dlv.isc.org works: the DLV records always occur in
pairs with both digest types.) But the second seems to be that
actually being adopted in most cases, e.g. the EPP extensions
of RFCs 4310/5910, or variations on the same theme.
RFC 4509 is over 4 years old now. Are there still validators around
that can only recognise DS records with digest type 1?
Chris Thompson University of Cambridge Computing Service,
Email: cet1 at ucs.cam.ac.uk New Museums Site, Cambridge CB2 3QH,
Phone: +44 1223 334715 United Kingdom.
More information about the Dnssec-deployment