On 27 Jul 2026, at 02:59, marka <[email protected]> wrote: > Now for PQ signing that uses multiple algorithms we can do that but by just > hoping that the validator has all algorithms involved or none of the > algorithms involved to sign the zone is not the way to go. We MUST assign a > DNSSEC algorithm code point for that algorithm pair and it MUST be published > in the DS RRset.
This sounds superficially like a combinatorial explosion, but I could imagine that in practice there are actually not many pairs needed in order to make progress. Perhaps even just (RSASHA256, ML-DSA-44) (ECDSAP256SHA256, ML-DSA-44) would be enough. > This tells the validator unless it supports that algorithm pair that it > should treat the zone as insecure. Additional I would use DNSKEYs with that > code point and use the first byte of the key field to identify which sub > algorithm it represents. I would also similarly identify the RRSIGs. Joe _______________________________________________ DNSOP mailing list -- [email protected] To unsubscribe send an email to [email protected]
