Re: Handling of RSASHA256 and RSASHA512 in BIND 9.6.0 and BIND 9.6.0-P1

2010-01-14 Thread Chris Thompson
On Dec 15 2009, Evan Hunt wrote: (Doug Barton wrote) BIND 9.6.2 is in the b1 phase atm, which means that there is plenty of time to get SHA2 in there and get the release out before a signed root goes live. I encourage the folks at ISC to do so, and if you agree I encourage you to make your

Re: Handling of RSASHA256 and RSASHA512 in BIND 9.6.0 and BIND 9.6.0-P1

2010-01-14 Thread Evan Hunt
We hear you. Expect a decision in the next few days. So, has the decision been made? [I am tentatively planning on going to 9.7 in production round about Easter, in good time for the RSASHA256-signed root zone in July, but it would be nice to have a fall-back option.] I'm sorry, I

Re: Handling of RSASHA256 and RSASHA512 in BIND 9.6.0 and BIND 9.6.0-P1

2009-12-15 Thread Chris Thompson
On Dec 15 2009, Doug Barton wrote: While this reminder is timely and helpful, more welcome would be the news that BIND 9.6.2 is going to have actual support for RSASHA{256|512}. My cursory reading of the 9.6.2b1 code does not seem to indicate that it does, although I would be happy to be proven

Re: Handling of RSASHA256 and RSASHA512 in BIND 9.6.0 and BIND 9.6.0-P1

2009-12-15 Thread Stephane Bortzmeyer
On Mon, Dec 14, 2009 at 08:05:40PM -0800, Doug Barton do...@dougbarton.us wrote a message of 44 lines which said: While this reminder is timely and helpful, more welcome would be the news that BIND 9.6.2 is going to have actual support for RSASHA{256|512}. No, it won't. Migrating to =

Re: Handling of RSASHA256 and RSASHA512 in BIND 9.6.0 and BIND 9.6.0-P1

2009-12-15 Thread Doug Barton
Chris Thompson wrote: (Evan Hunt) Adding SHA-2 to 9.6.x would violate our policy of making major functional changes only in major releases, so I don't expect we'll do that. Given the odd circumstances you mentioned, I won't say for certain that we won't--but I doubt it. 9.7.0 is going to

Re: Handling of RSASHA256 and RSASHA512 in BIND 9.6.0 and BIND 9.6.0-P1

2009-12-15 Thread Doug Barton
Evan Hunt wrote: BIND 9.6.2 is in the b1 phase atm, which means that there is plenty of time to get SHA2 in there and get the release out before a signed root goes live. I encourage the folks at ISC to do so, and if you agree I encourage you to make your voice heard. We hear you. That's

Re: Handling of RSASHA256 and RSASHA512 in BIND 9.6.0 and BIND 9.6.0-P1

2009-12-15 Thread Evan Hunt
BIND 9.6.2 is in the b1 phase atm, which means that there is plenty of time to get SHA2 in there and get the release out before a signed root goes live. I encourage the folks at ISC to do so, and if you agree I encourage you to make your voice heard. We hear you. Expect a decision in the

Re: Handling of RSASHA256 and RSASHA512 in BIND 9.6.0 and BIND 9.6.0-P1

2009-12-15 Thread Mark Andrews
In message prayer.1.3.2.0912151543550.32...@hermes-1.csi.cam.ac.uk, Chris Tho mpson writes: (But it's not too obvious to me that adding support for a new signing algorithm should necessarily be considered a major functional change.) If it was *just* adding a new signing algorithm then yes it

Re: Handling of RSASHA256 and RSASHA512 in BIND 9.6.0 and BIND 9.6.0-P1

2009-12-14 Thread Doug Barton
While this reminder is timely and helpful, more welcome would be the news that BIND 9.6.2 is going to have actual support for RSASHA{256|512}. My cursory reading of the 9.6.2b1 code does not seem to indicate that it does, although I would be happy to be proven wrong. I personally don't think it's