[dnsext] DS digest downgrade

["George Barwood" <[e-mail]>]

Via the dane group, I just realised that if DS records are provided for both SHA1 and SHA256, no extra security is obtained over using just SHA1.

That's because the SHA256 DS record could be for an unpublished DNSKEY in the child that happens to have the same Key Tag, so the verifier has to try the SHA1 digest if the SHA256 verification fails.

This seems unfortunate. You could have a rule that states that if SHA256 is used, it must be used "uniformly" ( or at least for all keys with the same algorithm and Key Tag ).

The alternative is to just not use SHA1 I suppose.

But this does seem like a design flaw, it's an obstacle for upgrading to better digest algorithms (SHA3?) if/when the current ones prove weak.

Was this ever discussed?

George