[DNSOP] Re: [Ext] Call for adoption: draft-huque-dnsop -multi-alg-rules-08 (Ends 2026-08-31)
Paul Hoffman <[email protected]>
| Newsgroups | gmane.ietf.dnsop |
|---|---|
| Message-ID | <[email protected]> |
Greetings. I like the idea of relaxing the "every algorithm must sign every RR" requirement from 4035/6840 in order to allow different KSK and ZSK algorithms, and to pre-populate. However, the rest of draft-huque-dnsop-multi-alg-rules feels wrong. The "UNIVERSAL" and "FORMERLY-UNIVERSAL" designations will tie DNSOP in knots for years, particularly with the introduction of post-quantum cryptography signatures. The document is wordy and at the same time mushy about the requirements. It is not clear where the use cases stop and the changes begin. I am against adopting draft-huque-dnsop-multi-alg-rules but would be in favor of a much shorter document that has just the necessary changes to RFC 4035/6480 to allow both the multi-signer model and new algorithms that are only partially supported by validators. I would be willing to help write such a small document. --Paul Hoffman _______________________________________________ DNSOP mailing list -- [email protected] To unsubscribe send an email to [email protected]