Re: DS Algorithm selection and SHA1 deprecation

[Mark Andrews <Mark_Andrews@isc.org>]

   Because zone administrators can not control the deployment support of
   SHA-256 in deployed validators that may referencing any given zone,
   deployments should consider publishing both SHA-1 and SHA-256 based
   DS records for a while.  Whether to publish both digest types
   together and for how long is a policy decision that extends beyond
   the scope of this document.

	I think this needs to be strengthend.  This currently allows
	you to use SHA-1 for one algorithm and SHA-256 for a different
	algorithm.  This really needs to be made pair-wise.  If you
	choose to publish both then you need to do this for every
	DNSKEY you are generating a DS for.

--
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: Mark_Andrews@isc.org

--
to unsubscribe send a message to namedroppers-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>