[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: private algorithms and the DS record
Edward Lewis wrote:
At 10:49 -0500 12/21/04, Samuel Weiler wrote:
Doesn't the DS hash already cover the name of the
algorithm, which is carried in the DNSKEY?
There is that safety net, yes. Maybe all hope is not lost.
There is still potential for a security problem, here, I think.
If an implementation pulls the private algorithm name from the DNSKEY
and eliminate the DNSKEY and DS before actually computing the SHA1 hash
of the DNSKEY.
This seems like a natural thing to do.
Certainly, there is a safer way to handle this, but how will a future
implementer be aware of the issue? By reading the namedropper archives?
--
David Blacka <davidb@verisignlabs.com>
Sr. Engineer VeriSign Applied Research
--
to unsubscribe send a message to namedroppers-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>