DNS Security (DNSSEC) DNSKEY Algorithm IANA Registry Updates
Extracted elements (8)
Algorithm number assignments 4, 9, and 11 are changed to 'Reserved' because they were placeholders for algorithms that were never fully specified for use with DNSSEC. Reserving them prevents potential conflicts with older implementations that may still reference these codes.
Older DNSSEC implementations may still have algorithm codes 4, 9, and 11 assigned. These codes are reserved rather than reallocated to prevent potential incompatibilities with such legacy implementations.
Algorithm number 1 (RSA/MD5, mnemonic RSAMD5) is marked deprecated in favor of algorithm 5 (RSA/SHA-1). It supports transaction security but not zone signing.
Algorithm number 5 (RSA/SHA-1, mnemonic RSASHA1) supports both zone signing and transaction security, defined in RFC 3110 and RFC 4034.
Algorithm numbers 15–122 are 'Unassigned' and algorithm numbers 123–251 are 'Reserved' per RFC 4034 and RFC 6014, providing range reservations for future DNSSEC algorithm allocation.
Algorithm numbers 253 (PRIVATEDNS) and 254 (PRIVATEOID) designate private algorithms supporting both zone signing and transaction security, as defined in RFC 4034.
The 'DNS Security (DNSSEC) Algorithm Numbers' sub-registry is updated by this document. Entries 4, 9, and 11 are changed to 'Reserved'; references for existing entries are updated. The DH Prime Lengths and DH Well-Known Prime/Generator Pairs sub-registries are not altered.
This document updates the DNSSEC Algorithm Numbers registry only for administrative correctness. It is not a discussion on algorithm superiority and raises no new security considerations.