On Mon, Jul 27, 2026 at 9:07 AM Paul Hoffman <[email protected]> wrote:
> On Jul 27, 2026, at 05:51, Shumon Huque <[email protected]> wrote: > > > > A new validator implementation could unilaterally impose that rule, sure. > > And it might. That would require that the validator had such a knob in its > config, and would be implementation-specific. > > > But ideally, there should be some general rule for algorithm downgrade > resistance that is signaled in the protocol, rather than special casing a > rule only for a specific algorithm. > > THERE BE DRAGONS! > > It is probably fine to have a signal that says "do not downgrade from {set > of PQ algorithms} to {set of classical algorithms}, but a signal that says > 'do not downgrade from {PQ alg 1} to {PQ alg 2} is inherently dangerous > because if alg 1 becomes weakened by a later attack, you have just created > a signal that basically forces a downgrade. > Yes, I agree. I would not propose per algorithm rules. So, some options might be: (1) All algorithm signatures must validate, (2) PQ algorithms can't be downgraded, (3) both PQ and Classical algorithms must validate. Shumon.
_______________________________________________ DNSOP mailing list -- [email protected] To unsubscribe send an email to [email protected]
