CC: Tomas Hozza <thozza@redhat.com>, nmavrogi@redhat.com
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Message-ID: <54B3CFC4.50108@redhat.com>
Organization: Red Hat
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.3.0
Subject: provide richer options for crypto configuration in BIND
Date: Mon, 12 Jan 2015 14:44:36 +0100
To: bind-suggest@isc.org
Content-Transfer-Encoding: 8bit
From: Petr Spacek <pspacek@redhat.com>
Content-Length: 998

Hello,

I would like to ask you for help with crypto consolidation project: Red Hat is
trying to consolidate crypto configuration on Linux systems to one place.

As you can see in https://bugzilla.redhat.com/show_bug.cgi?id=1179925, we have
tried to write a script which translates system-wide crypto policy into a
named.conf snippet (with the aim to forbid old/deprecated/insecure algorithms
and so on).

Unfortunately, it seems that BIND currently has very limited set of crypto
settings.

It would be really helpful if BIND could accept parameters like min-rsa-bits
and min-dh-bits (or at least specify the allowed DH groups). Also, there is no
way to specify algorithms and minimal accepted parameters/key sizes for HMAC
algorithms.

Maybe an option to specify algorithm white-lists instead of black-lists would
be nice way how to avoid surprises after upgrade.

What do you think about it? Would it be possible to implement something like that?

Have a nice day!

-- 
Petr Spacek  @  Red Hat