> On 29 Jul 2026, at 18:59, Philip Homburg <[email protected]> wrote: > >>> What the multi-algorithm draft basically says is that if a validator implem >> ents >>> either of RSASHA256 and ECDSA then it has to implement both. >> >> There are validators out there that DO NOT DO THAT. They are NOT >> broken. They are just old. > > RFC 6944 is from 2013. > >> By out of luck you mean they lookups will FAIL rather than being >> treated as INSECURE if the only RRSIGs are ECDSA. Then they will >> need to figure out why they failed, which most people will have >> trouble with. Then they have to figure out what to do. Not all >> implementations have NTAs. That leaves them with turning off DNSSEC >> but there are still millions of zones that support RSASHA256. > > I think the current statistic is that more zones are signed with ECDSA > then with RSA. > > If your validator is old enough that it can validate less than half of the > signed zones on the internet then maybe just turn it off? Obviously the > operator doesn't care about all the zones signed with ECDSA. > > There is a plan to switch the root zone to ECDSA in a few years. > (https://www.icann.org/en/public-comment/proceeding/proposed-root-ksk-algorithm-rollover-03-02-2026) > After that, the old validators will treat everything as insecure anyhow.
So what? While the root will be an issue EVERY other zone goes INSECURE as people migrate to new algorithms and lookups DO NOT FAIL. This is how DNSSEC was designed to work. To have GRACEFUL fallback with old validators. This attempt to break the bargain we made with the world is WRONG. It is bad engineering. -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: [email protected] _______________________________________________ DNSOP mailing list -- [email protected] To unsubscribe send an email to [email protected]
