RFC 6725

DNS Security (DNSSEC) DNSKEY Algorithm IANA Registry Updates

📅 published August 2012, from ietf

RFC 6725: DNS Security (DNSSEC) DNSKEY Algorithm IANA Registry Updates 🎀

Internet Engineering Task Force (IETF) ✨

Request for Comments: 6725
Author: Scott Rose, NIST 🧑‍💻
Category: Standards Track 🔥
Date: August 2012 📅
ISSN: 2070-1721
Updates: a set of entries in the IANA "DNS Security (DNSSEC) Algorithm Numbers" registry 🔄
Obsoletes: nothing is listed in the title block 🙈

Abstract 💖

Okay so DNSSEC needs cryptographic algorithm suites to make digital signatures over DNS data, and those algorithms are listed in an IANA-maintained registry. This doc makes some changes to a few entries in that registry. 💅

Status of This Memo 📝

This is an Internet Standards Track document. 🌟

It's a product of the IETF, which means it represents the consensus of the IETF community. It got public review and was approved for publication by the Internet Engineering Steering Group (IESG). More info on Internet Standards is in Section 2 of RFC 5741. 🧚

You can check the current status of this document, any errata, and how to give feedback at http://www.rfc-editor.org/info/rfc6725. 🔍

Copyright Notice ⭐

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as they're in effect on the publication date. Please read these carefully, because they spell out your rights and restrictions for this document. Any Code Components pulled out of this document must include Simplified BSD License text, as described in Section 4.e of the Trust Legal Provisions, and they come without warranty, as described in the Simplified BSD License. 🫶

Table of Contents 🦋

1. Introduction ....................................................2
2. The DNS Security Algorithm Numbers Sub-Registry .................2
   2.1. Updates and Additions ......................................2
   2.2. DNS Security Algorithm Numbers Sub-Registry Table ..........3
3. IANA Considerations .............................................4
4. Security Considerations .........................................4
5. Informative References ..........................................4

1. Introduction 🧚

Okay bestie, so DNSSEC is defined by [RFC4033], [RFC4034], [RFC4035], [RFC4509], [RFC5155], and [RFC5702], and it's giving source authentication and integrity protection, using digital signatures over DNS data. 🔐 It keeps an IANA registry of codes for digital signature algorithms. Each one is an asymmetric cryptographic algorithm paired with a one-way hash function. 🧠

This document updates a set of entries in the IANA registry called "DNS Security (DNSSEC) Algorithm Numbers." The updated entries are in Section 2.2 below. The list includes changes to a few entries that were set aside for future algorithm specs that never actually happened. Three of those entries are now "Reserved" so they don't cause conflicts with older implementations. 🙅‍♀️ The doc also updates the reference lists for entries. ✨

There are also auxiliary sub-registries tied to the DNS Security (DNSSEC) Algorithm Numbers registry. They cover different Diffie-Hellman parameters used with DNSSEC, and this document doesn't touch them. 💜

2. The DNS Security Algorithm Numbers Sub-Registry 🌈

The DNS Security Algorithm Numbers sub-registry is part of the Domain Name System Security (DNSSEC) Algorithm Numbers registry, and it has a bunch of entries with errors. 💀 Some other differences are described in Section 2.1, and the full list of changed registry entries is in Section 2.2. 📋

2.1. Updates and Additions 🎀

This document updates three entries in the Domain Name System Security (DNSSEC) Algorithm Numbers registry. 🔄

The description for assignment number 4 is changed to "Reserved." 🚫

The description for assignment number 9 is changed to "Reserved." 🚫

The description for assignment number 11 is changed to "Reserved." 🚫

These entries become "Reserved" because they were placeholders for algorithms that never got fully specified for DNSSEC. Older implementations might still have these algorithm codes assigned, so reserving them prevents potential incompatibilities. It's giving careful housekeeping. 🧹

2.2. DNS Security Algorithm Numbers Sub-Registry Table 🍓

Here are the changes to the DNS Security Algorithm Numbers sub-registry. Every other existing entry in the table is unchanged by this document and isn't shown here. The other two sub-registries (DNS KEY Record Diffie-Hellman Prime Lengths and DNS KEY Record Diffie-Hellman Well-Known Prime/Generator Pairs) aren't changed in any way by this document either. 🙌

                                          Zone     Trans.
 Number  Description       Mnemonic   Signing   Sec.       Reference
 ------  -----------       --------   -------   ---------  ---------
   0      Reserved                                         [RFC4034],
                                                           [RFC4398]

   1      RSA/MD5          RSAMD5        N         Y       [RFC3110],
          (deprecated;                                     [RFC4034]
          see 5)

   4      Reserved                                         [RFC6725]

   5      RSA/SHA-1        RSASHA1       Y         Y       [RFC3110],
                                                           [RFC4034]

   9      Reserved                                         [RFC6725]

  11      Reserved                                         [RFC6725]

15-122    Unassigned

123-251   Reserved                                         [RFC4034],
                                                           [RFC6014]

  253     private          PRIVATEDNS    Y         Y       [RFC4034]
          algorithm

  254     private          PRIVATEOID    Y         Y       [RFC4034]
          algorithm OID

3. IANA Considerations 🔮

This document updates a set of DNS Security Algorithm Numbers sub-registry entries, as given in Section 2.2. The changes move three registry entries to "Reserved" and update the reference list for entries. 🗂️

4. Security Considerations 🚨

This document updates the Domain Name System Security (DNSSEC) Algorithm Numbers registry. It is not meant to be a discussion on algorithm superiority, so please don't read it that way. No new security considerations are raised in this document. 🔒

5. Informative References 📚

[RFC3110]  Eastlake, D., "RSA/SHA-1 SIGs and RSA KEYs in the Domain
           Name System (DNS)", RFC 3110, May 2001.

[RFC4033]  Arends, R., Austein, R., Larson, M., Massey, D., and S.
           Rose, "DNS Security Introduction and Requirements",
           RFC 4033, March 2005.

[RFC4034]  Arends, R., Austein, R., Larson, M., Massey, D., and S.
           Rose, "Resource Records for the DNS Security Extensions",
           RFC 4034, March 2005.

[RFC4035]  Arends, R., Austein, R., Larson, M., Massey, D., and S.
           Rose, "Protocol Modifications for the DNS Security
           Extensions", RFC 4035, March 2005.

[RFC4398]  Josefsson, S., "Storing Certificates in the Domain Name
           System (DNS)", RFC 4398, March 2006.

[RFC4509]  Hardaker, W., "Use of SHA-256 in DNSSEC Delegation Signer
           (DS) Resource Records (RRs)", RFC 4509, May 2006.

[RFC5155]  Laurie, B., Sisson, G., Arends, R., and D. Blacka, "DNS
           Security (DNSSEC) Hashed Authenticated Denial of
           Existence", RFC 5155, March 2008.

[RFC5702]  Jansen, J., "Use of SHA-2 Algorithms with RSA in DNSKEY
           and RRSIG Resource Records for DNSSEC", RFC 5702,
           October 2009.

[RFC6014]  Hoffman, P., "Cryptographic Algorithm Identifier
           Allocation for DNSSEC", RFC 6014, November 2010.

Author's Address 🧑‍💻

Scott Rose
NIST
100 Bureau Dr.
Gaithersburg, MD  20899
USA

Phone: +1-301-975-8439
EMail: scottr.nist@gmail.com

That's the whole RFC, bestie! 🌈💖✨

📦 where this page comes from

ietf: rfc6725 2012-08
💖 girlified by claude-haiku-5-5 on 2026-10-17: a language model's rewrite of the original, under its terms