[DNSOP] Re: [Ext] Call for adoption: draft-huque-dnsop -multi-alg-rules-08 (Ends 2026-08-31)

> I like the
> idea of relaxing the "every algorithm must sign every RR" requirement
> from 4035/6840 in order to allow different KSK and ZSK algorithms,
> and to pre-populate. However, the rest of draft-huque-dnsop-multi-alg-rules
> feels wrong. The "UNIVERSAL" and "FORMERLY-UNIVERSAL" designations
> will tie DNSOP in knots for years, particularly with the introduction
> of post-quantum cryptography signatures. The document is wordy and
> at the same time mushy about the requirements. It is not clear
> where the use cases stop and the changes begin.
> 
> I am against adopting draft-huque-dnsop-multi-alg-rules but would
> be in favor of a much shorter document that has just the necessary
> changes to RFC 4035/6480 to allow both the multi-signer model and
> new algorithms that are only partially supported by validators. I
> would be willing to help write such a small document.

The current draft is the result of a long discussion. The UNIVERSAL and
FORMERLY-UNIVERSAL notions encode a lifecycle model where we can introduce
algorithms as universal, but also can get rid of them.

Maybe that can be done in a different way. In that case need a draft and
see if that is still useful for the use-cases that this draft tries to solve.

Initially, there is nothing special about post-quantum. Those algorithms can
become UNIVERSAL and then be added to the mix. 

What is special is the desire by some to prefer PQ algorithms. That would
require extra work if those algorithms would also want to be considered
UNIVERSAL.


_______________________________________________
DNSOP mailing list -- [email protected]
To unsubscribe send an email to [email protected]