Re: [dnsext] comments on draft-crocker-dnssec-algo-signal-03

[Michael Graff <[e-mail]>]

As long as it is statistical that's good. If it is used to filter  
rrsigs I feel that is bad. That is all.

A protocol to announce to some group once a month or something basic  
capabilities would be nice. Measured deployments of new and old  
protocols would really help decision making.

--Michael


On Jul 30, 2009, at 13:55, Joe Abley <[e-mail]> wrote:

>
> On 29-Jul-2009, at 23:35, bert hubert wrote:
>
>> On Wed, Jul 29, 2009 at 12:56 PM, Michael Graff<[e-mail]>  
>> wrote:
>>> Let me state some reasons I'm opposed to this draft's purpose,  
>>> even though I
>>> think some part of it would be very interesting to pursue.
>>
>> To add my reason why I'm opposed to this draft (versus its purpose):
>> The complexity of DNSSEC is already of such stunning magnitude that
>> almost anything that makes it even more complex, better have an earth
>> shatteringly good reason going for it.
>
> I think we either need to be prepared to roll algorithms in the  
> future, or we don't.
>
> If we do, then I think it's reasonable to think that in some cases  
> an algorithm roll will be mandated because of a perceived weakness  
> in one algorithm, and that the replacement algorithm may not be as  
> widely deployed as the weak algorithm.
>
> If we accept these points, then I think there's an operational need  
> to be able to measure deployment of the new algorithm. This was  
> Steve's point in his presentation yesterday, I think.
>
> I don't think the fall from grace of an algorithm will shatter the  
> earth, but it seems like something we should be prepared to do well.
>
>
> Joe

--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>