-------- Bas Westerbaan <[email protected]> wrote: > [1] A validator should insist on a signature with algorithm A if the > availability of A is signalled by the existence of the corresponding DS > and A has more confidence in the security of A than the other available > algorithms. We can do the same if it's not one preferred, but a couple > are equipreferable.
The DS record for alg A is the signal that the authoritative server(s) want algorithm A used :-) It's not a new signal, but it's a good one. Resolvers will need to do their due diligent on which things they support, and how they react to algorithm A failing signatures while algorithm B signature seems just fine. (Clue: it's probably B that was broken... but...) There is still the possibility (fading, I think) that one of the quantum-safe algorithms will fall to a non-quantum attack: That's why everyone wants hybrids. -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works | network architect [ ] [email protected] http://www.sandelman.ca/ | ruby on rails [ _______________________________________________ DNSOP mailing list -- [email protected] To unsubscribe send an email to [email protected]
