> On 29 Jul 2026, at 01:19, Philip Homburg <[email protected]> wrote: > >> There is a difference >> accepting any path and publishing zones that will FAIL TO VALIDATE >> AS SECURE OR INSECURE! DNSSEC was designed to fail insecure on >> old validators that didnt support any of the algorithms. The rules >> that the signer needs to sign ALL records with ALL of the algorithms >> in the DS set is designed to prevent validators with a properly >> signed zone getting answers that validate as BOGUS! Signers which >> do not follow that rule WILL (100% guaranteed) produce zones that >> will produce answers that validate as BOGUS on some validators. > > Sometimes the rules on what is acceptable on the Internet change. > > What the multi-algorithm draft basically says is that if a validator > implements > either of RSASHA256 and ECDSA then it has to implement both.
There are validators out there that DO NOT DO THAT. They are NOT broken. They are just old. > That is a change. And it does affect validators that implement only one > of them. That changes the rules of the games. That's life. > > This doesn't mean that all zone will immediately start using this feature. > I'm sure operators will carefully evaluate the impact. But maybe somebody > who is still running a decades old validator that does not support ECDSA > is out of luck. By “out of luck” you mean they lookups will FAIL rather than being treated as INSECURE if the only RRSIGs are ECDSA. Then they will need to figure out why they failed, which most people will have trouble with. Then they have to figure out what to do. Not all implementations have NTAs. That leaves them with turning off DNSSEC but there are still millions of zones that support RSASHA256. Trying to find updated code, but is that code still supported? Buying new hardware? All this because someone wants to use multiple signers and can’t organise themselves to use providers that support all the algorithms they want to use. As they say here in Australia. It doesn't pass the pub test. > If we look > athttps://www.iana.org/assignments/dns-sec-alg-numbers/dns-sec-alg-numbers.xhtml#dns-sec-alg-numbers-1 > then both RSASHA256 and ECDSA are MUST implement for DNSSEC validation. MUST implement is an instruction to IMPLEMENTORS shipping NEW code. It DOES NOT mean that vendors MUST add new algorithms to old code. It DOES NOT mean that validators MUST BE UPGRADED TO SUPPORT. Please don’t read more into those MUSTs than is actually ment. > So a validator that is potentially negatively affected by the draft is already > violating current requirements. No they are not. > I see no reason why that would stop this draft from progressing. Well I do. -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: [email protected] _______________________________________________ DNSOP mailing list -- [email protected] To unsubscribe send an email to [email protected]
