Re: [DNSOP] AD review of draft-ietf-dnsop-multi-provider-dnssec

[Matthijs Mekking]

On 1/21/20 6:03 PM, Tony Finch wrote:
> Matthijs Mekking <matth...@pletterpet.nl> wrote:
> 
>> I am not sure how they executed the algorithm rollover precisely.
>> Particularly, were there ever two DS records in the root zone with
>> different algorithms for these zones?
> 
> I can answer that :-)
> 
> Algorithm rollovers have to be double-KSK rollovers because DS records
> have to have a subset of the algorithms of the DNSKEY records. Having both
> algorithms in the DS record can only slow down the rollover so it's hard
> to think of situations where it would make sense (other than Shumon's
> multi-provider disagreement!)

As I suspected, in that case they were never candidate for the multiple
algorithms check.

_______________________________________________
DNSOP mailing list
DNSOP@ietf.org
https://www.ietf.org/mailman/listinfo/dnsop