[DNSOP] Re: Call for adoption: draft-huque-dnsop-multi-alg-rules-08 (Ends 2026-08-31)

[Mark Andrews <[e-mail]>]

This is fundamentally flawed. It assumes that EVERY validator in the world supports ALL of the algorithms a zone is signed with.

This is a “I want a pony” draft. It will not work for every validator.  Validator operators shouldn’t have to add NTAs, assuming that there implementation supports them, because people are to lazy to do due diligence when moving operators. 
-- 
Mark Andrews

> On 13 Aug 2026, at 23:46, Benno Overeinder via Datatracker <[e-mail]> wrote:
> 
> This message starts a dnsop WG Call for Adoption of:
> draft-huque-dnsop-multi-alg-rules-08
> 
> This Working Group Call for Adoption ends on 2026-08-31
> 
> Abstract:
>   This document restates the requirements on DNSSEC signing and
>   validation and makes small adjustments in order to allow for more
>   flexible handling of configurations that advertise multiple Secure
>   Entry Points (SEP) with different signing algorithms via their DS
>   record or trust anchor set.  The adjusted rules allow both for multi-
>   signer operation and for the transfer of signed DNS zones between
>   providers, where the providers support disjoint DNSSEC algorithm
>   sets.  In addition, the proposal enables pre-publication of a trust
>   anchor in preparation for an algorithm rollover, such as of the root
>   zone.
> 
>   This document updates RFCs 4035 and 6840.
> 
> Please reply to this message and indicate whether or not you support adoption
> of this Internet-Draft by the dnsop WG. Comments to explain your preference
> are greatly appreciated. Please reply to all recipients of this message and
> include this message in your response.
> 
> Authors, and WG participants in general, are reminded of the Intellectual
> Property Rights (IPR) disclosure obligations described in BCP 79 [2].
> Appropriate IPR disclosures required for full conformance with the provisions
> of BCP 78 [1] and BCP 79 [2] must be filed, if you are aware of any.
> Sanctions available for application to violators of IETF IPR Policy can be
> found at [3].
> 
> Thank you.
> [1] https://datatracker.ietf.org/doc/bcp78/
> [2] https://datatracker.ietf.org/doc/bcp79/
> [3] https://datatracker.ietf.org/doc/rfc6701/
> 
> The IETF datatracker status page for this Internet-Draft is:
> https://datatracker.ietf.org/doc/draft-huque-dnsop-multi-alg-rules/
> 
> There is also an HTML version available at:
> https://www.ietf.org/archive/id/draft-huque-dnsop-multi-alg-rules-08.html
> 
> A diff from the previous version is available at:
> https://author-tools.ietf.org/iddiff?url2=draft-huque-dnsop-multi-alg-rules-08
> 
> _______________________________________________
> DNSOP mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]