Re: [DNSOP] [Ext] Call for Adoption: draft-hoffman-dnssec-iana-cons

[Joe Abley <[e-mail]>]

On Jan 6, 2021, at 14:45, Ben Schwartz <bemasc=[e-mail]> wrote:

> That model works well when (a) all validators implement an algorithm you like OR (b) you view each algorithm as either "definitely strong" or "worthless" (no middle ground). 

We are in scenario (b).

When you sign a zone you choose one or more algorithms that are individually sufficient. Their relative strength is not important.

> Otherwise, the zone owner has a dilemma.  Should I protect fewer users with higher confidence, or more users with lower confidence?  I think that is the sticking point in this conversation.

I think zone owners are not protecting anybody; they are including a means to gauge authenticity in their responses so that validators can protect users.

There's nothing practically preventing validators from applying local policy in the way they determine whether a response is authentic. Whether or not that's a good idea is an interesting question, but I think it's orthogonal to how individual RRSets are signed. 

> Telling validators to "insist" that all signatures are valid would resolve this dilemma.  Zone owners could add algorithms without weakening anything.

How do you deploy a new signing algorithm alongside an established one without going dark to users using validators that don't support it, in that case?


Joe