> > What the multi-algorithm draft basically says is that if a validator implem > ents > > either of RSASHA256 and ECDSA then it has to implement both. > > There are validators out there that DO NOT DO THAT. They are NOT > broken. They are just old.
RFC 6944 is from 2013. > By out of luck you mean they lookups will FAIL rather than being > treated as INSECURE if the only RRSIGs are ECDSA. Then they will > need to figure out why they failed, which most people will have > trouble with. Then they have to figure out what to do. Not all > implementations have NTAs. That leaves them with turning off DNSSEC > but there are still millions of zones that support RSASHA256. I think the current statistic is that more zones are signed with ECDSA then with RSA. If your validator is old enough that it can validate less than half of the signed zones on the internet then maybe just turn it off? Obviously the operator doesn't care about all the zones signed with ECDSA. There is a plan to switch the root zone to ECDSA in a few years. (https://www.icann.org/en/public-comment/proceeding/proposed-root-ksk-algorithm-rollover-03-02-2026) After that, the old validators will treat everything as insecure anyhow. _______________________________________________ DNSOP mailing list -- [email protected] To unsubscribe send an email to [email protected]
