< draft-ietf-dnsop-dnssec-iana-cons-01.txt		draft-ietf-dnsop-dnssec-iana-cons-02.txt >
	Network Working Group P. Hoffman		Network Working Group P. Hoffman
	Internet-Draft ICANN		Internet-Draft ICANN
	Updates: 3658, 5155, 6014, 8624 (if July 21, 2021		Updates: 3658, 5155, 6014, 8624 (if approved) 23 August 2021
	approved)
	Intended status: Standards Track		Intended status: Standards Track
	Expires: January 22, 2022		Expires: 24 February 2022
	Revised IANA Considerations for DNSSEC		Revised IANA Considerations for DNSSEC
	draft-ietf-dnsop-dnssec-iana-cons-01		draft-ietf-dnsop-dnssec-iana-cons-02
	Abstract		Abstract
	This document changes the review requirements needed to get some		This document changes the review requirements needed to get DNSSEC
	DNSSEC algorithms and resource records added to IANA registries. It		algorithms and resource records added to IANA registries. It updates
	updates RFC 6014 to include hash algorithms for DS records and NSEC3		RFC 6014 to include hash algorithms for DS records and NSEC3
	parameters. It also updates RFC 5155 and RFC 6014, which have		parameters. It also updates RFC 5155 and RFC 6014, which have
	requirements for DNSSEC algorithms. It also updates RFC 8624 to say		requirements for DNSSEC algorithms, and updates RFC 8624 to say that
	that algorithms that are described in RFCs that are not on standards		algorithms that are described in RFCs that are not on standards track
	track are only at the "MAY" level of implementation recommendation.		are only at the "MAY" level of implementation recommendation. The
	The rationale for these changes is to bring the requirements for DS		rationale for these changes is to bring the requirements for DS
	records and for the hash algorithms used in NSEC3 in line with the		records and for the hash algorithms used in NSEC3 in line with the
	requirements for all other DNSSEC algorithms.		requirements for all other DNSSEC algorithms.
	Status of This Memo		Status of This Memo
	This Internet-Draft is submitted in full conformance with the		This Internet-Draft is submitted in full conformance with the
	provisions of BCP 78 and BCP 79.		provisions of BCP 78 and BCP 79.
	Internet-Drafts are working documents of the Internet Engineering		Internet-Drafts are working documents of the Internet Engineering
	Task Force (IETF). Note that other groups may also distribute		Task Force (IETF). Note that other groups may also distribute
	working documents as Internet-Drafts. The list of current Internet-		working documents as Internet-Drafts. The list of current Internet-
	Drafts is at https://datatracker.ietf.org/drafts/current/.		Drafts is at https://datatracker.ietf.org/drafts/current/.
	Internet-Drafts are draft documents valid for a maximum of six months		Internet-Drafts are draft documents valid for a maximum of six months
	and may be updated, replaced, or obsoleted by other documents at any		and may be updated, replaced, or obsoleted by other documents at any
	time. It is inappropriate to use Internet-Drafts as reference		time. It is inappropriate to use Internet-Drafts as reference
	material or to cite them other than as "work in progress."		material or to cite them other than as "work in progress."
	This Internet-Draft will expire on January 22, 2022.		This Internet-Draft will expire on 24 February 2022.
	Copyright Notice		Copyright Notice
	Copyright (c) 2021 IETF Trust and the persons identified as the		Copyright (c) 2021 IETF Trust and the persons identified as the
	document authors. All rights reserved.		document authors. All rights reserved.
	This document is subject to BCP 78 and the IETF Trust's Legal		This document is subject to BCP 78 and the IETF Trust's Legal
	Provisions Relating to IETF Documents		Provisions Relating to IETF Documents (https://trustee.ietf.org/
	(https://trustee.ietf.org/license-info) in effect on the date of		license-info) in effect on the date of publication of this document.
	publication of this document. Please review these documents
	carefully, as they describe your rights and restrictions with respect		Please review these documents carefully, as they describe your rights
	to this document. Code Components extracted from this document must		and restrictions with respect to this document. Code Components
	include Simplified BSD License text as described in Section 4.e of		extracted from this document must include Simplified BSD License text
	the Trust Legal Provisions and are provided without warranty as		as described in Section 4.e of the Trust Legal Provisions and are
	described in the Simplified BSD License.		provided without warranty as described in the Simplified BSD License.
	Table of Contents		Table of Contents
	1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2		1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2
	2. Update to RFC 6014 . . . . . . . . . . . . . . . . . . . . . 2		2. Update to RFC 6014 . . . . . . . . . . . . . . . . . . . . . 2
	3. Update to RFC 8624 . . . . . . . . . . . . . . . . . . . . . 3		3. Update to RFC 8624 . . . . . . . . . . . . . . . . . . . . . 2
	4. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 3		4. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 3
	5. Security Considerations . . . . . . . . . . . . . . . . . . . 3		5. Security Considerations . . . . . . . . . . . . . . . . . . . 3
	6. References . . . . . . . . . . . . . . . . . . . . . . . . . 4		6. References . . . . . . . . . . . . . . . . . . . . . . . . . 3
	6.1. Normative References . . . . . . . . . . . . . . . . . . 4		6.1. Normative References . . . . . . . . . . . . . . . . . . 3
	6.2. Informative References . . . . . . . . . . . . . . . . . 4		6.2. Informative References . . . . . . . . . . . . . . . . . 4
	Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 5		Appendix A. Acknowledgements . . . . . . . . . . . . . . . . . . 4
			Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 4
	1. Introduction		1. Introduction
	DNSSEC is primarily described in [RFC4033], [RFC4034], and [RFC4035].		DNSSEC is primarily described in [RFC4033], [RFC4034], and [RFC4035].
	DNSSEC commonly uses two resource records beyond those defined in RFC		DNSSEC commonly uses two resource records beyond those defined in RFC
	4034: DS [RFC3658] and NSEC3 [RFC5155].		4034: DS [RFC3658] and NSEC3 [RFC5155].
	[RFC8126] describes the requirements for listing in the myriad IANA		[RFC8126] gives guidelines for listing in the myriad IANA registries.
	registries.
	[RFC6014] updated the requirements for how DNSSEC cryptographic		[RFC6014] updated the requirements for how DNSSEC cryptographic
	algorithm identifiers in the IANA registries are allocated, reducing		algorithm identifiers in the IANA registries are assigned, reducing
	the requirements from being "Standards Action" to "RFC Required".		the requirements from being "Standards Action" to "RFC Required".
	However, the IANA registry requirements for hash algorithms for DS		However, the IANA registry requirements for hash algorithms for DS
	records and for the hash algorithms used in NSEC3 are still		records [RFC3658] and for the hash algorithms used in NSEC3 [RFC5155]
	"Standards Action".		are still "Standards Action". This document updates those IANA
			registry requirements.
	2. Update to RFC 6014		2. Update to RFC 6014
	Section 4 updates RFC 6014 to bring the requirements for DS records		Section 4 updates RFC 6014 to bring the requirements for DS records
	and NSEC3 hash algorithms in line with the rest of the DNSSEC		and NSEC3 hash algorithms in line with the rest of the DNSSEC
	cryptographic algorithms by allowing any DS or NSEC3 hash algorithms		cryptographic algorithms by allowing any DS or NSEC3 hash algorithms
	that are fully described in an RFC to have identifiers allocated in		that are fully described in an RFC to have identifiers assigned in
	the IANA registries. This is an addition to the IANA considerations		the IANA registries. This is an addition to the IANA considerations
	in RFC 6014.		in RFC 6014.
	3. Update to RFC 8624		3. Update to RFC 8624
	This document updates [RFC8624] for all DNSKEY and DS algorithms that		This document updates [RFC8624] for all DNSKEY and DS algorithms that
	are not on standards track.		are not on standards track.
	The second paragraph of Section 1.2 of RFC 8624 currently says:		The second paragraph of Section 1.2 of RFC 8624 currently says:
	This document only provides recommendations with respect to		This document only provides recommendations with respect to
	mandatory-to-implement algorithms or algorithms so weak that they		mandatory-to-implement algorithms or algorithms so weak that they
	cannot be recommended. Any algorithm listed in the [DNSKEY-IANA] and		cannot be recommended. Any algorithm listed in the [DNSKEY-IANA]
	[DS-IANA] registries that are not mentioned in this document MAY be		and [DS-IANA] registries that are not mentioned in this document
	implemented. For clarification and consistency, an algorithm will be		MAY be implemented. For clarification and consistency, an
	specified as MAY in this document only when it has been downgraded		algorithm will be specified as MAY in this document only when it
	from a MUST or a RECOMMENDED to a MAY.		has been downgraded from a MUST or a RECOMMENDED to a MAY.
	That paragraph is now replaced with the following:		That paragraph is now replaced with the following:
	This document provides recommendations with respect to mandatory-to-		This document provides recommendations with respect to
	implement algorithms, algorithms so weak that they cannot be		mandatory-to-implement algorithms, algorithms so weak that they
	recommended, and algorithms that are defined in RFCs that are not on		cannot be recommended, and algorithms that are defined in RFCs
	standards track. Any algorithm listed in the [DNSKEY-IANA] and [DS-		that are not on standards track. Any algorithm listed in the
	IANA] registries that are not mentioned in this document MAY be		[DNSKEY-IANA] and [DS-IANA] registries that are not mentioned in
	implemented. For clarification and consistency, an algorithm will be		this document MAY be implemented. For clarification and
	specified as MAY in this document only when it has been downgraded		consistency, an algorithm will be specified as MAY in this
	from a MUST or a RECOMMENDED to a MAY.		document only when it has been downgraded from a MUST or a
			RECOMMENDED to a MAY.
	This update is also reflected in the IANA considerations in		This update is also reflected in the IANA considerations in
	Section 4.		Section 4.
	4. IANA Considerations		4. IANA Considerations
	In the "Domain Name System Security (DNSSEC) NextSECure3 (NSEC3)		In the "Domain Name System Security (DNSSEC) NextSECure3 (NSEC3)
	Parameters" registry, the registration procedure for "DNSSEC NSEC3		Parameters" registry, the registration procedure for "DNSSEC NSEC3
	Flags", "DNSSEC NSEC3 Hash Algorithms", and "DNSSEC NSEC3PARAM Flags"		Flags", "DNSSEC NSEC3 Hash Algorithms", and "DNSSEC NSEC3PARAM Flags"
	are changed from "Standards Action" to "RFC Required".		are changed from "Standards Action" to "RFC Required".
	skipping to change at page 5, line 5 ¶		skipping to change at page 4, line 45 ¶
	Requirements and Usage Guidance for DNSSEC", RFC 8624,		Requirements and Usage Guidance for DNSSEC", RFC 8624,
	DOI 10.17487/RFC8624, June 2019,		DOI 10.17487/RFC8624, June 2019,
	<https://www.rfc-editor.org/info/rfc8624>.		<https://www.rfc-editor.org/info/rfc8624>.
	6.2. Informative References		6.2. Informative References
	[RFC3658] Gudmundsson, O., "Delegation Signer (DS) Resource Record		[RFC3658] Gudmundsson, O., "Delegation Signer (DS) Resource Record
	(RR)", RFC 3658, DOI 10.17487/RFC3658, December 2003,		(RR)", RFC 3658, DOI 10.17487/RFC3658, December 2003,
	<https://www.rfc-editor.org/info/rfc3658>.		<https://www.rfc-editor.org/info/rfc3658>.
	Author's Address		Appendix A. Acknowledgements
			Donald Eastlake and Murray Kucherawy contributed to this document.
			Author's Address
	Paul Hoffman		Paul Hoffman
	ICANN		ICANN
	Email: paul.hoffman@icann.org		Email: paul.hoffman@icann.org
End of changes. 18 change blocks.
	46 lines changed or deleted		50 lines changed or added
This html diff was produced by rfcdiff 1.48. The latest version is available from http://tools.ietf.org/tools/rfcdiff/