On Mon, Jul 27, 2026 at 5:58 AM Peter Thomassen <peter= [email protected]> wrote:
> Hi Bas, > > What do you mean by downgrade-secure? That a signer can sign with PQC and > a conventional algorithm, and when the validator doesn't support the > former, it uses the latter, whereas when a validator supports it, it would > rely on the PQC one only (such that invalid PQC sigs are rejected > (SERVFAIL) instead of being overridden by the conventional ones)? > > If so, DNSSEC provides no solution for that today. It may be useful to > find one, but it's orthogonal to this draft, so I'd propose to discuss it > in a separate thread and maybe think about a draft. > Yes, indeed. The multi-alg rules draft, in this regard, does not really go in the opposite direction of the current DNSSEC design. It merely restates the rule in RFC 6840 (DNSSEC Clarifications) that validators should accept any algorithm path, and not insist that all algorithm paths validate. This rule enables the use cases that motivate our draft, hence of course, we did not propose to modify it. This is actually a common misconception about DNSSEC (that I actually suffered from for a time too, as the security guarantees that DNSSEC provides are not very clearly explained in any existing doc). DNSSEC has never offered algorithm downgrade protection, only protection from being downgraded to insecure. The validator rules proposed in the draft for "formerly universal" algorithms are designed to deal with cases where validators have disabled support for a formerly universal algorithm, so that they can gracefully degrade such zones to unsigned without causing SERVFAIL. One question that comes to mind would be whether PQC-priority over > conventional (if PQC is supported) should be a validator-side policy, or > whethre that should be signaled somehow, for example in the DNSKEY rdata by > prepending a list of algorithm number that this key overrides (that is, > validators cannot accept RRSIGs with the listed algorithms if they support > PQC). > I agree that it is useful to discuss whether we need an algorithm downgrade enhancement in DNSSEC, but yes, additional explicit signaling is likely needed for that, and it would be a painful slog to get the long tail of validators in the field upgraded to implement such an enhancement. It may be better to bundle such a proposed enhancement in DELEG, where validators would need to change anyway. In fact, in early DELEG discussions a number of years ago, I had proposed (verbally) that DELEG should support signaling of new zone level properties like algorithm downgrade protection. The use case I had in mind was where a zone could dictate that both PQC and Classical signatures need to validate successfully. Shumon.
_______________________________________________ DNSOP mailing list -- [email protected] To unsubscribe send an email to [email protected]
