DNS Security (DNSSEC) DNSKEY Algorithm IANA Registry Updates NIST 100 Bureau Dr.Gaithersburg20899MDUSA+1-301-975-8439 scottr.nist@gmail.com
Internet Area
DNS Extensions Working Group DNSDNSSEC
The DNS Security Extensions (DNSSEC) requires the use of
cryptographic algorithm suites for generating digital signatures over DNS data. The algorithms specified for
use with DNSSEC are reflected in an IANA maintained registry. This document presents a set of changes for
some entries of the registry.
The Domain Name System (DNS) Security Extensions (DNSSEC) , ,
, , , and
uses digital signatures over DNS data
to provide source authentication and integrity protection. DNSSEC uses an IANA registry
to list codes for digital signature algorithms (consisting of a cryptographic
algorithm and one-way hash function).
This document updates a set of entries in the IANA registry for Domain Name
System Security (DNSSEC) Algorithm Numbers. These new entries are given in Section 2.2 below. This list includes changes to selected entries originally set aside for future algorithm specification that did
not occur. These three entries are changed to "Reserved" to avoid potential conflicts with older implementations. This
document also brings the list of references for entries up to date.
There are auxillery registries related to the Domain Name System Security (DNSSEC) Algorithm Numbers registry
that deal with various Diffie-Hellmen parameters used with DNSSEC. These registry tables are not altered by
this document.
The DNS Security Algorithm Number sub-registry (part of the Domain Name
System (DNS) Security Number registry) contains a set of entries that contain errors.
There are additional differences to entries that are described in sub-section 2.1 and
the complete list of changed registry entries is in sub-section 2.2.
This document updates three entries in the Domain Name System Security (DNSSEC)
Algorithm Registry. They are:
The description for assignment number 4 is changed to "Reserved".
The description for assignment number 9 is changed to "Reserved".
The description for assignment number 11 is changed to "Reserved".
The above values are changed to "Reserved" because they were placeholders for algorithms that
were not fully specified for use with DNSSEC. Older implementations may still have these algorithm
codes assigned, so these codes are reserved to prevent potential incompatibilities.
The list of Domain Name System (DNS) Security Algorithm Number registry entry changes are
given below. All other existing entries in the registry table are unchanged by this document
and are not shown.
The other two tables in this registry (DNS KEY Record Diffie-Hellman Prime Lengths and
DNS KEY Record Diffie-Hellman Well-Known Prime/Generator Pairs) are not changed in any way
by this document.
Zone Trans.
Number Description Mnemonic Sign Sign Reference
------ ----------- -------- ---- ------ ---------
0 Reserved [RFC4034],
[RFC4398]
1 RSA/MD5 RSAMD5 N Y [RFC3110],
(Depricated, [RFC4034]
see 5)
4 Reserved [THISDOC]
5 RSA/SHA-1 RSASHA1 Y Y [RFC3110]
[RFC4034]
9 Reserved [THISDOC]
11 Reserved [THISDOC]
15-122 Unassigned [RFC4034]
123-251 Reserved [RFC4034],
[RFC6014]
252 Reserved for INDIRECT N N [RFC4034]
Indirect keys
253 private PRIVATE Y Y [RFC4034]
algorithm
254 private PRIVATEOID Y Y [RFC4034]
algorithm OID
255 Reserved [RFC4034]
This document updates a set of Domain Name System (DNS) Security Algorithm Numbers registry entries
as given in Section 2.2. The changes include moving three registry entries to "Reserved" and updating the reference list for entries.
The original Domain
Name System (DNS) Security Algorithm Number registry is
available at http://www.iana.org/assignments/dns-sec-alg-numbers.
This document replaces the Domain Name System (DNS) Security Algorithm Numbers registry with an updated table.
It is not meant
to be a discussion on algorithm superiority. No new security considerations are
raised in this document.