ietf-corpus

rfc-7218

Adding Acronyms to Simplify Conversations about DNS-Based Authentication of Named Entities (DANE)

O. Gudmundsson
date2014-04 streamIETF areasec wgdane statusPROPOSED STANDARD pages5 canonicalhttps://www.rfc-editor.org/rfc/rfc7218 doi10.17487/RFC7218
Experience has shown that people get confused when discussing the three numeric fields of the TLSA record. This document specifies descriptive acronyms for the three numeric fields in TLSA records. This document updates the format of the IANA registry created by RFC 6698.

updates

Extracted elements (7)

design-rationale §1

People were repeatedly confused about the numeric values and field order in TLSA records during discussions about adding DANE to new protocols. Descriptive acronyms were added to the IANA registry to reduce this confusion without changing the DANE protocol itself.

dns, security, registry

interoperability-note §1

DANE parsers in applications and DNS software are expected to support parsing the acronyms for each TLSA field in addition to numeric values, enabling use of human-readable forms like 'PKIX-TA CERT SHA2-512' in place of '0 0 2'.

dns, security, tls

normative-requirement §2 MUST

As acronyms are offered for human consumption, case does not matter. Software that parses TLSA records MUST handle upper-, mixed-, or lower-case characters as input when processing acronyms.

dns, security

registry §2.1

The TLSA Certificate Usages registry is updated with an acronym column. Values: 0=PKIX-TA (CA constraint), 1=PKIX-EE (Service certificate constraint), 2=DANE-TA (Trust anchor assertion), 3=DANE-EE (Domain-issued certificate), 255=PrivCert (Reserved for Private Use), 4-254 unassigned.

dns, security, registry, pkix, tls

registry §2.3

The TLSA Matching Types registry is updated with an acronym column. Values: 0=Full (No hash used), 1=SHA2-256 (256-bit hash by SHA2), 2=SHA2-512 (512-bit hash by SHA2), 255=PrivMatch (Reserved for Private Use), 3-254 unassigned.

dns, security, registry, crypto

registry §2.2

The TLSA Selectors registry is updated with an acronym column. Values: 0=Cert (Full certificate), 1=SPKI (SubjectPublicKeyInfo), 255=PrivSel (Reserved for Private Use), 2-254 unassigned.

dns, security, registry, pkix, tls

security-consideration §4

This document only changes registry fields and does not change the behavior of any protocol. The intent is to reduce confusion, which is expected to lead to better specification and operations.

dns, security, registry