IETF Logo Mail Archive

[DNSOP] Re: [Ext] Call for adoption: draft-huque-dnsop-multi-alg-rules-08 (Ends 2026-08-31)

Paul Hoffman <paul.hoffman@icann.org> Tue, 18 August 2026 18:43 UTC

Return-Path: <paul.hoffman@icann.org>
X-Original-To: dnsop@mail2.ietf.org
Delivered-To: dnsop@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 52B9F12BDED0B for <dnsop@mail2.ietf.org>; Tue, 18 Aug 2026 11:43:13 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1787078593; bh=zzj6+w6wWQLqY0qt21RByPJrhF2+vqAygiATRmqEQ0A=; h=From:To:Subject:Date:References:In-Reply-To; b=Ujdxnd8wU1tjI/lPrvCitLQW9BMdiUcKDAnGy8mvvggdJSJ8b+dRiNE+oq9gw0pTp HLDkcU8usQuASxV7fQiu1bYeL2jE1uRd9ZZ+IU+7tqly5yBgUhza9vSmoUUZyEiAv5 FTk4LKWH757O5zkpw9k+Ky0QlvHKjgj3G/J2qPWg=
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -4.399
X-Spam-Level:
X-Spam-Status: No, score=-4.399 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=icann.org
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ddwZQtJIeq0Y for <dnsop@mail2.ietf.org>; Tue, 18 Aug 2026 11:43:12 -0700 (PDT)
Received: from ppa4.dc.icann.org (ppa4.dc.icann.org [192.0.46.77]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id 8E76612BDED06 for <dnsop@ietf.org>; Tue, 18 Aug 2026 11:43:12 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=icann.org; h= content-id:content-transfer-encoding:content-type:date:from :in-reply-to:message-id:mime-version:references:subject:to; s= able; bh=zzj6+w6wWQLqY0qt21RByPJrhF2+vqAygiATRmqEQ0A=; b=lb5b8vD U0gEgzI/j/lAlYC1WqC/h4Xk930PI49ZUcaTtk4UZ4w1nD9mlKUN/rAK+wm0JEvU GE1THwk0RgdoIkKlUlzk5f0kNwkahSI7uQnNhuagXn2RYZ6hblWIo6To9JBbNett knZBlJ+WXRyEm7KwaIMXunZVXFB6oVeyuaZxLublSWPaB2J2Ik2Pj/PPX578TinQ m/PF7YBiuhCivUDDMc+SrlyWpKxnyg0rm4gWqiPNww3zGmYm/UVx60Sl8lQhU3/q P9AzayuKp2wwZ7Py0nynbcyxgKKcssPTwMDmWRmwLVDmT2Crire0pCSEO13aFbde mBs0esFCYVGlp2w==
Received: from MBX112-E2-CO-1.pexch112.icann.org (out.mail.icann.org [64.78.33.7]) by ppa4.dc.icann.org (8.18.1.11/8.18.1.11) with ESMTPS id 67IIh5js638126 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for <dnsop@ietf.org>; Tue, 18 Aug 2026 18:43:05 GMT
Received: from MBX112-W2-CO-1.pexch112.icann.org (10.226.41.128) by MBX112-W2-CO-1.pexch112.icann.org (10.226.41.128) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.46; Tue, 18 Aug 2026 11:43:04 -0700
Received: from MBX112-W2-CO-1.pexch112.icann.org ([169.254.44.235]) by MBX112-W2-CO-1.pexch112.icann.org ([169.254.44.235]) with mapi id 15.02.2562.046; Tue, 18 Aug 2026 11:43:04 -0700
From: Paul Hoffman <paul.hoffman@icann.org>
To: "dnsop@ietf.org" <dnsop@ietf.org>
Thread-Topic: [Ext] [DNSOP] Call for adoption: draft-huque-dnsop-multi-alg-rules-08 (Ends 2026-08-31)
Thread-Index: AQHdKyoq3XhiG/9nt02Nxd1dSnla+LakodIA
Date: Tue, 18 Aug 2026 18:43:04 +0000
Message-ID: <F96F0012-1B8F-4673-A2F3-F9E46C809E67@icann.org>
References: <178662874440.76825.3626833739189514877@dt-datatracker-559c48c7fb-b8xm6>
In-Reply-To: <178662874440.76825.3626833739189514877@dt-datatracker-559c48c7fb-b8xm6>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-originating-ip: [192.0.32.235]
x-source-routing-agent: True
Content-Type: text/plain; charset="us-ascii"
Content-ID: <AFF8C76DDB84384F9568788FD7C9D75C@pexch112.icann.org>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-08-18_03,2026-08-18_01,2025-10-01_01
Message-ID-Hash: Z4FJZJENSM7GU45XN7N2YLIWRP32ZGOD
X-Message-ID-Hash: Z4FJZJENSM7GU45XN7N2YLIWRP32ZGOD
X-MailFrom: paul.hoffman@icann.org
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-dnsop.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [DNSOP] Re: [Ext] Call for adoption: draft-huque-dnsop-multi-alg-rules-08 (Ends 2026-08-31)
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/P5vBkSJT36G69H0z2CXVTlRnKZo>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Owner: <mailto:dnsop-owner@ietf.org>
List-Post: <mailto:dnsop@ietf.org>
List-Subscribe: <mailto:dnsop-join@ietf.org>
List-Unsubscribe: <mailto:dnsop-leave@ietf.org>

Greetings. I like the idea of relaxing the "every algorithm must sign every RR" requirement from 4035/6840 in order to allow different KSK and ZSK algorithms, and to pre-populate. However, the rest of draft-huque-dnsop-multi-alg-rules feels wrong. The "UNIVERSAL" and "FORMERLY-UNIVERSAL" designations will tie DNSOP in knots for years, particularly with the introduction of post-quantum cryptography signatures. The document is wordy and at the same time mushy about the requirements. It is not clear where the use cases stop and the changes begin.

I am against adopting draft-huque-dnsop-multi-alg-rules but would be in favor of a much shorter document that has just the necessary changes to RFC 4035/6480 to allow both the multi-signer model and new algorithms that are only partially supported by validators. I would be willing to help write such a small document.

--Paul Hoffman

v2.46.0 | Report a Bug | By Email | System Status