Re: [dnsext] comments on draft-crocker-dnssec-algo-signal-03

[Joe Abley <[e-mail]>]

On 29-Jul-2009, at 23:35, bert hubert wrote:

> On Wed, Jul 29, 2009 at 12:56 PM, Michael Graff<[e-mail]> wrote:
>> Let me state some reasons I'm opposed to this draft's purpose, even  
>> though I
>> think some part of it would be very interesting to pursue.
>
> To add my reason why I'm opposed to this draft (versus its purpose):
> The complexity of DNSSEC is already of such stunning magnitude that
> almost anything that makes it even more complex, better have an earth
> shatteringly good reason going for it.

I think we either need to be prepared to roll algorithms in the  
future, or we don't.

If we do, then I think it's reasonable to think that in some cases an  
algorithm roll will be mandated because of a perceived weakness in one  
algorithm, and that the replacement algorithm may not be as widely  
deployed as the weak algorithm.

If we accept these points, then I think there's an operational need to  
be able to measure deployment of the new algorithm. This was Steve's  
point in his presentation yesterday, I think.

I don't think the fall from grace of an algorithm will shatter the  
earth, but it seems like something we should be prepared to do well.


Joe


--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>