IETF Logo Mail Archive

[DNSOP] Re: Local validation policy to require valid PQ path where available

Carlos Horowicz <carlos@planisys.com> Fri, 14 August 2026 14:21 UTC

Return-Path: <carlos@planisys.com>
X-Original-To: dnsop@mail2.ietf.org
Delivered-To: dnsop@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id BA999129D2691 for <dnsop@mail2.ietf.org>; Fri, 14 Aug 2026 07:21:02 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1786717262; bh=jjeqoS7mg2BEWdadPF7A41J7k09t+trHX54BznYbrC4=; h=Date:Subject:To:References:From:In-Reply-To; b=QeJxzMnL8uPL+4+hTb5dxQDqoT95s63RAqeF4/wLM/SuPWu5aYjYuV3Y4WudlrsAU hryvhGKEQ/OdlZ/GLzPa3J+Y6A3MkoF13EGINg1BCUWRHVQJlq/pwx++ukuVtAhrHX rCBe2+58IAA8sErkRBKU6qETcmqGCKeTupxhJpXc=
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -2.098
X-Spam-Level:
X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (1024-bit key) header.d=planisys.com
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FqSTojhe9bt6 for <dnsop@mail2.ietf.org>; Fri, 14 Aug 2026 07:21:01 -0700 (PDT)
Received: from avas-out-planisys-3.planisys.net (avas-out-planisys-3.planisys.net [194.34.167.83]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id 68CB7129D2687 for <dnsop@ietf.org>; Fri, 14 Aug 2026 07:21:01 -0700 (PDT)
Received: from localhost (localhost [127.0.0.1]) by avas-out-planisys-3.planisys.net (Postfix) with ESMTP id 1DA8124F6BD for <dnsop@ietf.org>; Fri, 14 Aug 2026 11:20:54 -0300 (-03)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=planisys.com; h= content-transfer-encoding:content-type:content-type:in-reply-to :from:from:references:content-language:subject:subject :user-agent:mime-version:date:date:message-id:received:received; s=selector1; t=1786717251; x=1788531652; bh=jjeqoS7mg2BEWdadPF7 A41J7k09t+trHX54BznYbrC4=; b=DDvblXEu5kjPXV30gpLSEJYhaIt2LLiIdRk KCCp1aA7VtOpueXPMMt7ORnsGVRQhmPdKPJRLeJs8bNbim07fE40K2B7GWaEGVLc xgpoXEfTlrohFgfqyJs3hS/qaUM6KM5g6nVg20x1RY2Ijp0U4b104PeTvxF+uQfz qBTcT2+E=
X-Virus-Scanned: Debian amavisd-new at avas-out-planisys-3.planisys.net
Received: from avas-out-planisys-3.planisys.net ([127.0.0.1]) by localhost (avas-out-planisys-3.planisys.net [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Kw3-1WMY1AJA for <dnsop@ietf.org>; Fri, 14 Aug 2026 11:20:51 -0300 (-03)
Received: from [192.168.1.19] (unknown [90.163.115.45]) (Authenticated sender: carlos@planisys.com) by avas-out-planisys-3.planisys.net (Postfix) with ESMTPSA id A455324F6BB for <dnsop@ietf.org>; Fri, 14 Aug 2026 11:20:51 -0300 (-03)
Message-ID: <9d86b857-c04f-4e75-a2b2-301a188fc19b@planisys.com>
Date: Fri, 14 Aug 2026 16:20:49 +0200
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Content-Language: en-US
To: dnsop@ietf.org
References: <m1wun5n-0000MtC@stereo.hq.phicoh.net> <D615866C-49EF-4D24-8747-70DCA9B9FE30@strandkip.nl>
From: Carlos Horowicz <carlos@planisys.com>
Autocrypt: addr=carlos@planisys.com; keydata= xsFNBFnGm9cBEADbeI+G75qBP7sqeCKQvTxdetkTsawSZfSiuHXuEfxDPoIV0FeMrKFjIKez k73ymhZ3qnq9EVUbQZHaili0INlWNHCqxAiD54Cf0OUecw690krT7PKAUHKQBuk/rVbysPQ9 yG9GDZCMDwXW7sqI2jOX66fg9LfwgouJdi99TUxLPddPdSYW5olfjupqRinOOZiYTY+crkIJ 9SyA/wAzq4jWiCvEAhoZaUSM1cqhy+qyF15vQIP3qfaFgmEKUYGiGCEF6Aur2epSabs5ZmHh DhvMFpZFK8MZOxl4iuIAam89tQyu9w3boEa6IOzNHwGfndPnDecFVyhBdygNihJ7ETBkjykJ xsuQ48lpiL5kZuO3w9DYaP6ZnFv9iElGSokdJNYyZlr4L/sNN5HMo4pa8qDdoL4QqGfxvYFr qaagL3ibsn1MQoZnNR6OaZ6bN3LLsxqEdTDPJnSQDe3h2Neh9a1Rwr9PE7oOzsopEtPMoODr P7EtbFRWL9b+vKWe47mYBXwlY1MYQ2ICppzt4winBhgwp4IBfgISMlfqEyEZssgA7n41im6e qgd+BOJljLhrE5x28aqO7BfSoVHK8zcpGPdXNRo48vyMbITVchJOeloyrLi8sTOLE7tQ0s/q kR8dxfIcUD16L1wbdl9SBDX3rFqWa92LPr09ObQ9t0a8S8ua0wARAQABzSdDYXJsb3MgQSBI b3Jvd2ljeiA8Y2FybG9zQHBsYW5pc3lzLmNvbT7CwY4EEwEKADgCGyMFCwkIBwMFFQoJCAsF FgIDAQACHgECF4AWIQQfSfXWL5rjL9KTf6WTcNFZxCXlGgUCZxDdHgAKCRCTcNFZxCXlGt0l EACwEcqopnIBU0Cf7c9AaeSZAD9rPekwkOFIkasqsu3JIpybETwMT281wGjgeamj7kghGGJr FATF16bEE6F0SZBH5K+nd2R2adtZT9noZzo/2rpyvZhlXLh7j48KAayOqa3qkIUadxvZnFX1 KmGrTElMCG8IhJNPiMZpbAe2syZkMKku7nlQ8TPb7TpecmUIEYcfv5bgKYaEekqEA0I95Pp5 q4KSYMw5z4k+BD36Zji0WlHEQJwzOOuErk2j9WVtPrhu2KyeJ7MpO6oiZ4e2hQjJ7JvPlqPL BcjxjU7ltpYLtETPpR65LNap+2wgAKVItTWkNpmSMlGiREcZrKTHQrzs5c4K6BlMmV+0XU9y CP6z8/P+3Wa3LmEZ7Mpg0aovKTeLZ1f8Pzih7iGFN9TCYKURQtZMVu41PT/DCb4ObZ0EWVYX rUxCHW2sgM1ZZ3+hzJhtPuyqYwFuQS0SzULAkWch+vxp4KAhy1ECTV97C/stpVit+FIDPadh ZG3+pM0fTi4MN3gzZiMNmKmvOsCR9aH6KQ8swuzCzV1nbD2TlIftFWv3RJ+hCjTcK698GDv0 ArmzXe/6rx7r2aamCUw469U2cdtqzYLw8a8Jksa/yD+Y1A+F2sZdkTpkEwAFj2tlJlUEAtkk Bd1157Cx427TrvbjtbiUGYMc0uAXb/x65NCTXM7BTQRZxpvXARAAsYVS+RatNHUkCLem7sJG dgmD65Qpdgp9wcN324Ry/Q6DTvi7QfzGJmhWKTN+Zhq9suZ182M+7GePqpIzTU2yYJkvqJOa W8BH9jb//2oYbS6yVIG/CvU5a+OERw1YZgZ71yrBVTzCiZhPWlriXhLT38R0ovzCyL62AP6A UB04dvsDnLv6d3E+gg3T2twVionO1YKFvWKYthKUCDuTtudK5RS+nFyDueujxzoervCRXciD 8LcjjX9POqbLOZ4JHUWs9J7bUntQbSMlLjS7eRzpqoNKHD+aLHxQpjQOQE58Q8IqSdKLNgW3 uxYxlHAB1De/N/rmEj5kddIJ+v2Ks+3iNk24PpScbdu48hgZtafxnMdeg8FTnoi2Qh+ng2Hu 73qOftIwwqF0M8p6tfFzPKBW1guFaETse1s3SvS+fGLuRpogFkQu6JhAXjb/IjJDA9SbcGF6 BmRrplWKnyqGyy4WTWa0G2l8wrCdo8kVjS/9lNRlcl4SQCiX0pof3yKyIKxpCIQKmJVzpHbr BfpuXW5cb0iJX3Da1bXjPGHgrm65azoYvxPB4ZdfkYEmTxvYWoJ6RVs0W9U3Rix1M9DPqraE GDMCaeLCgm3agsDsDkmdKhOEhklcfkjbvk7UZcQia/x372LBBh0saI8EocRn/Xqa3sP+sIY1 HvAok2a4QfJalnMAEQEAAcLBdgQYAQoAIAIbDBYhBB9J9dYvmuMv0pN/pZNw0VnEJeUaBQJn EN1gAAoJEJNw0VnEJeUarCIP/0mAL1jgI4OHhaAvxdNXJJIe9j0nYXoYoz9d542Ub4YGwavF OX0qWxKVm5dUAnNSjKijUIIu4V100GsbK7nRSnejT4ZmW9dTn+G5yvgo5ms4Y1LEdnHmExuv kTCkyo9Qbrs0eQQIHyvwbBzI8RyrUahhbKF+NnzzYdLPg0R7be0vbxeezPAzvkcE7rOlWedy i0GwOCqbJOTLK9qJzWZpmSctxETT6jx/Kj3VSf1BPyVKfT16HmHAddLEBteh/wA1rAgFI2v/ L0oQjnvW+kl6/EPPfuVB1eHX+DT/D3FIeBm3Mvk7xkSKgtzD3KQjXNz6mdJ9R/93893lc6HA NiDrxqjIehG0IDP/xUW6BA0cJEBkf+1dgSH+tT8Gu3YeC8ILM24d9YaYNZnCopr0gnGhDNK+ jdxqWIEINHyBONY5Ke3Z1yhnPHTJND4Mm1uMDd3kteGr48AyIXKl+cdthAHZVWsCLSqZvHOI GUrLJHxzL3t+kVewcoHSB+2jBhIaE+sxxiR303l60xGceJktYbK+0A3cPw1jhlWZZsS3YCes phvBZmY8jvOaVekSyGiU0p3lpuNabFpm5ffSwo+6fFEEWtjWwushBssmC/KRRuSRjBd/TCYs Bdsx2xgyNZTRYpl20cvUihR42uCjq+RkjnF0GC//JvOWHDf6peMDexAzCVjZ
In-Reply-To: <D615866C-49EF-4D24-8747-70DCA9B9FE30@strandkip.nl>
Content-Type: text/plain; charset="UTF-8"; format="flowed"
Content-Transfer-Encoding: 7bit
Message-ID-Hash: 6YBQ7P6HMFVOBHLK6FIBCTSZVWIB6MEX
X-Message-ID-Hash: 6YBQ7P6HMFVOBHLK6FIBCTSZVWIB6MEX
X-MailFrom: carlos@planisys.com
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-dnsop.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [DNSOP] Re: Local validation policy to require valid PQ path where available
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/ZvcEE4v16SdJ_vICM-WCdbpfI5E>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Owner: <mailto:dnsop-owner@ietf.org>
List-Post: <mailto:dnsop@ietf.org>
List-Subscribe: <mailto:dnsop-join@ietf.org>
List-Unsubscribe: <mailto:dnsop-leave@ietf.org>

Joe

do you imagine that implementations would eventually expose this local 
policy via directives like

pqc-validation-policy normal; # accept any valid signature

and

pqc-validation-policy require-if-present; #require PQC signature to 
validate without fallback to e.g. ECDSA

?

-Carlos

On 14/08/2026 11:03, Joe Abley wrote:
> On 14 Aug 2026, at 10:17, Philip Homburg <pch-dnsop-7@u-1.phicoh.com> 
> wrote:
>
>> An issue that may need to be addressed is the desire to strictly prefer
>> PQC algorithms over traditional ones. That may conflict with the concepts
>> used in this draft. It would be nice to deal with that in this draft
>> though it could be addressed later when we create standards for PQC.
>
> This seems like a reasonable moment to mention that I wrote up 
> something about this the other day.
>
> Changing the fundamental architecture for algorithm agility in DNSSEC 
> from "any valid path is acceptable" to "some valid paths are mandatory 
> and some are optional" depending on algorithms seems controversial. 
> Which is not to say that I am suggesting it shouldn't happen. I think 
> change will be necessary but I think it will be complicated to find 
> consensus.
>
> In the mean time, early implementers can use the remaining local 
> policy provision to gain operational experience. This draft describes 
> such a policy and includes guidance for how to communicate the local 
> policy to those affected by it.
>
> Perhaps this approach would give us some more breathing room to be 
> able to make more informed changes in the future.
>
> https://datatracker.ietf.org/doc/draft-jabley-dnsop-local-signing-algorithm-policy/
>
>
> Joe
>
>
> _______________________________________________
> DNSOP mailing list -- dnsop@ietf.org
> To unsubscribe send an email to dnsop-leave@ietf.org

v2.46.0 | Report a Bug | By Email | System Status