Somewhat late to the party, but better late than never. I fully agree with everything in Libor’s response below. I think that this is an important document that really ought to move forward.
In addition to its importance for multi-signer and simplification of algorithm rollovers it should be added that if this document was to be standardized it would enable PQ-DNSSEC zones to use a strong PQ-safe algorithm like ML-DSA-44 while using a small-signature algorithm for the rest of the zone. While we don’t have any standardized PQ-safe small-signature algorithms today this document is still an important prerequisite to being able to use them when they get standardized. Finally, a very important property of this proposal is that it is easy to deploy, because RFC6840-compliant resolvers (i.e. all resolvers) already support this. I.e. to deploy a zone using multi-algorithms only require control over the signer (easy) and the authoritative servers (also easy). The part that are not under the control of the zone owner (the resolvers) are already done. Johan > On 22 Oct 2025, at 11:37, Libor Peltan <[email protected]> > wrote: > > I'm full supporting this document, as it clarifies the grey area between > "validators MUST take any valid path" and "signers MUST sign will all > algorithms in DS set", and simplifies algorithm roll-over, while enabling so > far impossible operational modes like different-algorithm multi-signer. > > Regarding the specific "TL;DR" motivational section, I consider it > comprehensible and helpful. > > I'm looking forward for this document to move forward. > > Libor _______________________________________________ DNSOP mailing list -- [email protected] To unsubscribe send an email to [email protected]
