> > I've implemented the basic support for draft-westerbaan-dnssec-mldsa-04 in > BIND 9: > > https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/12769 > > The optimizations for large keys/signatures will come in a separate MR. > This requires > some brainstorming and experiments whether fragmented UDP is safe to fetch > large > DNSSEC records or an unconditional switch to TCP will be needed. > > Of course, OpenSSL makes this way harder than it should be with > differences how > retain_seed option works between 3.x and 4.x :-( > > This is going to be most likely merged into November BIND 9 releases. >
Nice! > Test domains: > mldsa44.dnstest.dev - NOERROR; flags: qr rd ra ad; QUERY: 1, ANSWER: 2, > AUTHORITY: 0, ADDITIONAL: 1 > valid.mldsa44.dnstest.dev - NOERROR; flags: qr rd ra ad; QUERY: 1, > ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1 > invalid.mldsa44.dnstest.dev - SERVFAIL > expired.mldsa44.dnstest.dev - SERVFAIL > invalid-dnskey.mldsa44.dnstest.dev - SERVFAIL > expired-dnskey.mldsa44.dnstest.dev - SERVFAIL > dual-valid.mldsa44.dnstest.dev - NOERROR; flags: qr rd ra ad; QUERY: 1, > ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1 > upgrade.mldsa44.dnstest.dev - NOERROR after a timeout; flags: qr rd ra > ad; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1 > downgrade.mldsa44.dnstest.dev - NOERROR; flags: qr rd ra ad; QUERY: 1, > ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1 > Are you planning to add support for downgrade protection? Best, Bas > > Ondrej > -- > Ondřej Surý (He/Him) > [email protected] > > A gentle nudge is always appreciated if I take a little longer to reply. > >
_______________________________________________ DNSOP mailing list -- [email protected] To unsubscribe send an email to [email protected]
