Re: BIND 9.18.6 disables RSASHA1 at runtime?

2022-09-02 Thread Anand Buddhdev
On 01/09/2022 23:19, Mark Andrews wrote: Hi Mark, Yes. You will need to restart the server. Okay, I'm trying out 9.18.6 on an Oracle Linux 9 server. When starting BIND, it doesn't log anything about disabling RSASHA1. But when I query it for ietf.org/SOA, I get an unvalidated response. BIND

Re: BIND 9.18.6 disables RSASHA1 at runtime?

2022-09-02 Thread Mark Andrews
We don’t log rsamd5 is disabled now ec or ed curves when they are not supported by the crypto provider. Why should rsasha1 based algs be special? -- Mark Andrews > On 2 Sep 2022, at 20:37, Anand Buddhdev wrote: > > On 01/09/2022 23:19, Mark Andrews wrote: > > Hi Mark, > >> Yes. You will

Re: BIND 9.18.6 disables RSASHA1 at runtime?

2022-09-02 Thread Bjørn Mork
Mark Andrews writes: > We don’t log rsamd5 is disabled now ec or ed curves when they are not > supported by the crypto provider. Why should rsasha1 based algs be > special? Because RSASHA1 validation still is a MUST in RFC8624? MD5 is and ED is not. I don't know if disabled EC curves is a real

Re: Mailing list questions (DMARC, ARC, more?)

2022-09-02 Thread Matus UHLAR - fantomas
On 25.08.22 18:10, Alessandro Vesely wrote: The lack of interest by others proves that From: munging is not so much of a nuisance as they say... On Mon 29/Aug/2022 12:09:10 +0200 Matus UHLAR - fantomas wrote: This will come sooner or later, however: earlier this year I've done small dmarc re

Re: BIND 9.18.6 disables RSASHA1 at runtime?

2022-09-02 Thread Anand Buddhdev
On 02/09/2022 13:53, Mark Andrews wrote: Hi Mark, We don’t log rsamd5 is disabled now ec or ed curves when they are not supported by the crypto provider. Why should rsasha1 based algs be special? The problem I see with 9.18.6 is that at startup, it is checking to see if it can validate RSA