Re: [secdir] review of draft-ietf-dnsext-dnssec-gost-05

[Paul Hoffman <[e-mail]>]

At 1:22 PM -0500 1/8/10, Andrew Sullivan wrote:
>On Fri, Jan 08, 2010 at 08:12:29AM -0800, Paul Hoffman wrote:
>
>> It is for this reason that DNSSEC does not, for example, require
>> that resolvers MUST be able to validate RSA signatures with 256-bit
>> keys. However, by saying that resolvers MUST be able to validate
>> anything other than the widely-agreed-to algorithms, you are opening
>> up such an attack.
>
>Now, this is an interesting point.

Thank you. However, it is far from original.

>I think if one combines this
>argument with Steve's point that a certain baseline of mandatory
>algorithms should be required _only_ because you need some common set
>for interoperability, one has a pretty good argument that most
>algorithms should be MAYs and not stronger.

Bingo. If there is an algorithm that the technical community thinks is the "next" mandatory algorithm, you might want to make it "SHOULD+", but even that proposal is not always clear-cut.

<cue the peanut gallery>