Re: [dnsext] MAR proposal #2: Allowing pre-publishing of DNSKEYs

[Paul Hoffman <[e-mail]>]

On Apr 1, 2011, at 4:28 PM, Samuel Weiler wrote:

> For additional operational and zone-signing flexibility, particularly
> to allow the publication of a DNSKEY of a new algorithm before a zone
> is fully signed with that algorithm, we propose to change these rules
> to use ONLY the DS RRset for algorithm signalling, not the DNSKEY
> RRset.
> 
> Zones will be required to be signed with each algorithm (though not
> necessarily eack key) present in the zone's DS RRset or configured
> trust anchors.

I oppose this because it makes DNSSEC more brittle for no good cryptographic reason. If a zone no longer trusts a signature algorithm, they can stop using it.

--Paul Hoffman