Re: [DNSOP] [Ext] Call for Adoption: draft-hoffman-dnssec-iana-cons

[Ben Schwartz <[e-mail]>]

On Wed, Jan 6, 2021 at 3:37 PM Joe Abley <[e-mail]> wrote:

> On Jan 6, 2021, at 14:45, Ben Schwartz <bemasc=[e-mail]>
> wrote:
>
> > That model works well when (a) all validators implement an algorithm you
> like OR (b) you view each algorithm as either "definitely strong" or
> "worthless" (no middle ground).
>
> We are in scenario (b).
>

I think the long half-life of RSA-1024 is an example of a violation of
(b).  I bet there are many operators who view it as neither strong nor
worthless.  SHA-1 post-SHAtter is another possible concern.


> When you sign a zone you choose one or more algorithms that are
> individually sufficient. Their relative strength is not important.
>

I agree, that's what the RFCs effectively require, but it's not the only
possible arrangement.

...

> There's nothing practically preventing validators from applying local
> policy in the way they determine whether a response is authentic. Whether
> or not that's a good idea is an interesting question, but I think it's
> orthogonal to how individual RRSets are signed.
>

I don't think it is orthogonal.  The prevalent local validator policies
change the effect that zone owner choices will have, so zone owners need to
know what those policies are.

> Telling validators to "insist" that all signatures are valid would
> resolve this dilemma.  Zone owners could add algorithms without weakening
> anything.
>
> How do you deploy a new signing algorithm alongside an established one
> without going dark to users using validators that don't support it, in that
> case?
>

To clarify, I meant "all signatures under algorithms that are implemented
by the validator", i.e. "check everything you can".


>
>
> Joe