Hi, I've implemented the basic support for draft-westerbaan-dnssec-mldsa-04 in BIND 9:
https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/12769 The optimizations for large keys/signatures will come in a separate MR. This requires some brainstorming and experiments whether fragmented UDP is safe to fetch large DNSSEC records or an unconditional switch to TCP will be needed. Of course, OpenSSL makes this way harder than it should be with differences how retain_seed option works between 3.x and 4.x :-( This is going to be most likely merged into November BIND 9 releases. Test domains: mldsa44.dnstest.dev - NOERROR; flags: qr rd ra ad; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1 valid.mldsa44.dnstest.dev - NOERROR; flags: qr rd ra ad; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1 invalid.mldsa44.dnstest.dev - SERVFAIL expired.mldsa44.dnstest.dev - SERVFAIL invalid-dnskey.mldsa44.dnstest.dev - SERVFAIL expired-dnskey.mldsa44.dnstest.dev - SERVFAIL dual-valid.mldsa44.dnstest.dev - NOERROR; flags: qr rd ra ad; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1 upgrade.mldsa44.dnstest.dev - NOERROR after a timeout; flags: qr rd ra ad; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1 downgrade.mldsa44.dnstest.dev - NOERROR; flags: qr rd ra ad; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1 Ondrej -- Ondřej Surý (He/Him) [email protected] A gentle nudge is always appreciated if I take a little longer to reply. _______________________________________________ DNSOP mailing list -- [email protected] To unsubscribe send an email to [email protected]
