Re: [DNSOP] [Ext] DNSSEC Strict Mode

[Ben Schwartz <[e-mail]>]

Viktor,

I think your analysis of the problems of current deployment are convincing
and useful.  Thanks!

> Improving practices in this space will do a lot more to improve
> DNSSEC security than downgrade-resistant key algorithm signalling.

I agree.  The Strict Mode draft is, in a sense, based on the pessimistic
assumption that we won't be able to sufficiently improve these practices,
so we'll need to be able to tolerate second-rate signature algorithms.
That could be because of outdated clients, postquantum concerns, or
conflicting national crypto requirements.  Also, the bar will be higher if
we believe that DNSSEC is not only for partial defense and special uses,
but a global security layer on par with HTTPS.

It's clear that the working group is not convinced.  That's fine!  As long
as everyone is aware of the challenge, we can revive this approach if it
becomes necessary.