DNS Extensions (dnsext) Internet Drafts

Signaling Cryptographic Algorithm Understanding in DNSSEC

draft-ietf-dnsext-dnssec-algo-signal-10.txt

Date: 08/04/2013

Authors: Steve Crocker, Scott Rose

Working Group: DNS Extensions (dnsext)

Formats: xml txt

The DNS Security Extensions (DNSSEC) were developed to provide origin authentication and integrity protection for DNS data by using digital signatures. These digital signatures can be generated using different algorithms. This draft sets out to specify a way for validating end-system resolvers to signal to a server which digital signature and hash algorithms they support. The proposed extensions allow the signaling of new algorithm uptake in client code to allow zone administrators to know when it is possible to complete an algorithm rollover in a DNSSEC signed zone.

DNS Extensions (dnsext)

Last Modified: 2009-04-13

Additional information is available at tools.ietf.org/wg/dnsext

Chair(s):

Olafur Gudmundsson <ogud@ogud.com>

Andrew Sullivan <ajs@shinkuro.com>

Internet Area Director(s):

Ralph Droms <rdroms@cisco.com>

Jari Arkko <jari.arkko@piuha.net>

Internet Area Advisor:

Ralph Droms <rdroms@cisco.com>

Mailing Lists:

General Discussion: namedroppers@ops.ietf.org
To Subscribe: namedroppers-request@ops.ietf.org
Archive: http://ops.ietf.org/lists/namedroppers/

Description of Working Group:

The DNS has a large installed base and repertoire of protocol
specifications. The DNSEXT WG group will actively advance DNS
protocol-related RFCs on the standards track while thoroughly
reviewing further proposed extensions. The scope of the DNSEXT WG is
confined to the DNS protocol, particularly changes that affect DNS
protocols "on the wire" or the internal processing of DNS data. DNS
operations are out of scope for the WG.

The WG will limit itself to review of proposals for new extensions,
clarification to the DNS protocol, including DNSSEC, and review of
DNS protocol related work which may originate elsewhere in the IETF,
including AD-sponsored submissions or drafts in other working groups.
Adoption of new DNSEXT standards track working group items will require
changes to this charter. The WG does not intend to hold face to face
meetings, though may do so if deemed necessary for resolution of a
specific issue at hand.

The DNSEXT WG will conduct the specified RFC2929bis review of RR
templates as they are posted and also maintain a living ID of errata
for the DNSSEC document set.

Goals and Milestones:

Done		Forward NSEC rdata to IESG for Proposed Standard
Done		Forward RFC2535-bis to IESG for proposed standard
Done		Forward Case Insensitive to IESG for Proposed Standard
Done		Forward LLMNR to IESG for Proposed Standard
Done		Update boilerplate text on OPT-IN
Done		Forward Wildcard clarification to IESG for proposed standard
Feb 2007		Submit KEY algorithm documents RFC253[69]bis and RFC3110 to IESG for proposed standard
Done		Finalize Zone Enumeration Requirements
Jun 2007		Start of process of reviewing the following RFCs and to move them to Draft Standard status
Jul 2007		RFC2930 (TKEY) to Draft standard
Jul 2007		RFC2181 (Clarify) to Draft Standard
Jul 2007		RFC2136 (Dynamic Update) to Draft Standard
Jul 2007		RFC2308 (Neg Caching) to Draft Standard
Jul 2007		RFC3007 (Secure Update) to Draft Standard
Jul 2007		RFC2782 (SRV RR) to Draft Standard
Jul 2007		RFC2671 (EDNS0) to Draft Standard
Jul 2007		RFC1995 (IXFR) to Draft standard
Jul 2007		RFC2672 (DNAME) to Draft Standard or revision
Jul 2007		RFC1996 (Notify) to Draft Standard
Jul 2007		Submit to IESG RFC2845 (TSIG)to Draft standard
Jul 2007		RFC1982 (Serial Number Arithmetic)
Jul 2007		FRC2539 (DH Key RR) to Draft Standard
Jul 2007		RFC3226 (Message Size) to Draft Standard
Done		RFC2538 (CERT RR) to Draft Standard
Done		Forgery Resilience advanced to IESG
Oct 2008		DNAMEbis advanced to IESG
Nov 2008		ENDS0bis advanced to IESG
Nov 2008		AXFR-clarify advanced to IESG
Dec 2008		DNS-profile advanced to IESG
Feb 2009		RFC2536bis and RFC2539bis advanced to IESG.

Internet-Drafts:

DNS Zone Transfer Protocol (AXFR) (49974 bytes)
Clarifications and Implementation Notes for DNSSECbis (25844 bytes)
Use of SHA-2 algorithms with RSA in DNSKEY and RRSIG Resource Records for DNSSEC (20005 bytes)
Update to DNAME Redirection in the DNS (35995 bytes)
Deprecation of HMAC-MD5 in DNS TSIG and TKEY Resource Records (10284 bytes)
DNS Proxy Implementation Guidelines (27928 bytes)

Request For Comments:

IETF Secretariat - Please send questions, comments, and/or suggestions to ietf-web@ietf.org.

Return to working group directory.

Return to IETF home page.