> There is a difference > accepting any path and publishing zones that will FAIL TO VALIDATE > AS SECURE OR INSECURE! DNSSEC was designed to fail insecure on > old validators that didnt support any of the algorithms. The rules > that the signer needs to sign ALL records with ALL of the algorithms > in the DS set is designed to prevent validators with a properly > signed zone getting answers that validate as BOGUS! Signers which > do not follow that rule WILL (100% guaranteed) produce zones that > will produce answers that validate as BOGUS on some validators.
Sometimes the rules on what is acceptable on the Internet change. What the multi-algorithm draft basically says is that if a validator implements either of RSASHA256 and ECDSA then it has to implement both. That is a change. And it does affect validators that implement only one of them. That changes the rules of the games. That's life. This doesn't mean that all zone will immediately start using this feature. I'm sure operators will carefully evaluate the impact. But maybe somebody who is still running a decades old validator that does not support ECDSA is out of luck. If we look at https://www.iana.org/assignments/dns-sec-alg-numbers/dns-sec-alg-numbers.xhtml#dns-sec-alg-numbers-1 then both RSASHA256 and ECDSA are MUST implement for DNSSEC validation. So a validator that is potentially negatively affected by the draft is already violating current requirements. I see no reason why that would stop this draft from progressing. _______________________________________________ DNSOP mailing list -- [email protected] To unsubscribe send an email to [email protected]
