And how should that signal be interpreted if only the classical signature on it could be validated?
On Mon, Jul 27, 2026 at 3:51 PM Shumon Huque <[email protected]> wrote: > On Mon, Jul 27, 2026 at 9:07 AM Paul Hoffman <[email protected]> > wrote: > >> On Jul 27, 2026, at 05:51, Shumon Huque <[email protected]> wrote: >> > >> > A new validator implementation could unilaterally impose that rule, >> sure. >> >> And it might. That would require that the validator had such a knob in >> its config, and would be implementation-specific. >> >> > But ideally, there should be some general rule for algorithm downgrade >> resistance that is signaled in the protocol, rather than special casing a >> rule only for a specific algorithm. >> >> THERE BE DRAGONS! >> >> It is probably fine to have a signal that says "do not downgrade from >> {set of PQ algorithms} to {set of classical algorithms}, but a signal that >> says 'do not downgrade from {PQ alg 1} to {PQ alg 2} is inherently >> dangerous because if alg 1 becomes weakened by a later attack, you have >> just created a signal that basically forces a downgrade. >> > > Yes, I agree. I would not propose per algorithm rules. So, some options > might be: (1) All algorithm signatures must validate, (2) PQ algorithms > can't be downgraded, (3) both PQ and Classical algorithms must validate. > > Shumon. > > _______________________________________________ > DNSOP mailing list -- [email protected] > To unsubscribe send an email to [email protected] >
_______________________________________________ DNSOP mailing list -- [email protected] To unsubscribe send an email to [email protected]
