Re: [DNSOP] [Ext] Call for Adoption: draft-hardaker-dnsop-rfc8624-bis, must-not-sha1, must-not-ecc-gost

[Paul Wouters <[e-mail]>]

On Wed, 1 May 2024, Mark Andrews wrote:

> One got servfail because validators where not aware that support was ripped away underneath it. Validators started to get errors that where totally unexpected. Performing runtime testing of algorithm support addressed that by allowing the validator to skip the unsupported algorithm.

The runtime check for SHA1 helped put RSA-SHA1 / NSEC3-RSA-SHA1 into 
the "unsupported" category, but RSA-SHA256 with NSEC3 still uses SHA1
for hashing the QNAME, and while not cryptogrpahic use, still had
problems in practise. I don't remember the full details, but I think
it related to wildcard proofs of non-existence of some kind, leading
to validation failures.

Paul