Deprecate Usage of ECC-GOST within DNSSEC
Extracted elements (9)
GOST R 34.10-2001 and GOST R 34.11-94 were deprecated by Rosstandart (Russia's Federal Agency for Technical Regulation and Metrology) in August 2012 and superseded by GOST 34.10-2012 and GOST 34.11-2012. The newer 2012 algorithms remain supported in DNSSEC via RFC 9558 and are unaffected by this document.
Zone operators using ECC-GOST-based algorithms should switch to supported algorithms. DNS registries should prohibit clients from uploading and publishing ECC-GOST-based DS records to ensure DNSSEC validation remains functional.
GOST R 34.10-2001 (ECC-GOST) MUST NOT be used when creating DNSKEY and RRSIG records. Validating resolvers MUST treat RRSIG records created from DNSKEY records using these algorithms as unsupported algorithms.
GOST R 34.11-94 MUST NOT be used when creating Delegation Signer (DS) records. Validating resolvers MUST treat GOST R 34.11-94 DS records as insecure.
If no other DS records of accepted cryptographic algorithms are available after encountering a GOST R 34.11-94 DS record, the DNS records below the delegation point MUST be treated as insecure.
If no other RRSIG records of accepted cryptographic algorithms are available after encountering an ECC-GOST RRSIG, the validating resolver MUST consider the associated resource records as insecure.
IANA updated the GOST R 34.10-2001 (algorithm number 12) entry in the 'DNS Security Algorithm Numbers' registry to mark it DEPRECATED, with 'Use for DNSSEC Signing', 'Use for DNSSEC Validation', 'Implement for DNSSEC Signing', and 'Implement for DNSSEC Validation' all set to MUST NOT.
IANA updated the GOST R 34.11-94 (value 3) entry in the 'Digest Algorithms' registry to mark it DEPRECATED, with 'Use for DNSSEC Delegation', 'Use for DNSSEC Validation', 'Implement for DNSSEC Delegation', and 'Implement for DNSSEC Validation' all set to MUST NOT.
Deprecating ECC-GOST potentially increases the security of the DNSSEC ecosystem by removing algorithms that are no longer recommended for use, as they were superseded by newer GOST 2012 algorithms in August 2012.