[dns-wg] DNSSEC Provisioning for ERX Space Held with ARIN

Hi,

> This is excellent news. Thanks to all at RIPE NCC for their persistence with
> getting this on the road,
We would also like to acknowledge the support of ARIN, without which this could
not have been done.

> Is there some technical reason that you can't check digest type 2
> (SHA-256) records? It wouldn't seem to be exactly bleeding edge
> technology!
Our DelChecker is up for renewal and this will include support for things as
SHA-256. It is a bit too early for me to give a release date just yet. Please
bear with us.

Until then you can still publish SHA-256 trust anchors. It just means that we
will not verify them before publication.

A note on the bleeding edge part. While I agree that the technology is not that
new, it is unfortunately still the case that on most systems crypto libraries do
_not_ support it. OpenSSL on most vanilla Linux distributions is just one example.

Regards,
Wolfgang