This came up in a discussion today, and I had some thoughts about it before, so I'll write this message to hope that it doesn't get lost.
There are two things for me that motivate this, one the on hand the Cloudflare experiment with downgrade protection and the other is the notion that other protocols, such as TLS and SSH, are using hybrid algorithms. So the idea is the following: the zone owner (or the signer on behalf of the zone owner) should be able to signal intent to the validator. For example, the zone could signal that PQC downgrade protection is supported. This means that the entire zone is signed with a PQC algorithm and that a validator that implements downgrade protection can saefely do that without risk of bogus result due to the lack of PQC signatures. A zone could also signal support for hybrid validation where the validator checks both a PQC signature and a classical (EC or RSA) one. This means that the entire zone signed by two algorithms. And that a validator could decided to only consider an RRset properly signed when both check out. Some operators may want to use a PQC KSK and a short-lived ECDSA ZSK. And they want to signal that this is not an attack but intentionally. Finally, there may be zone signed by multiple parties in a multi-signer setup who are in various states of transitioning to PQC algorithms. Note, the idea is to signal the intent of the zone owner (or signer). It is not a requirement that a validator implements downgrade protection, hybrid or anything else. I will leave out potential solutions to this to just focus on requirements. I think this is something we need to pick up. Probably not here in dnsop, but this is all I've got at the moment. So in the future dns* wg or in a dedicated PQC wg. _______________________________________________ DNSOP mailing list -- [email protected] To unsubscribe send an email to [email protected]
