Re: Q2: crypto algorithm requirements for DNSSEC

[Mark.Andrews@isc.org]

> There is a difference between "MUST implement" and "MUST use".  We
> could always specify "must implement" for two algorithms, but provide
> language that suggests that you should use one and should not use the
> other.

	The problem is that if you don't sign with both you can't
	easily withdraw one of them when you need to.  The resolver
	can protect itself if both signatures are there.  It can
	simple choose to ignore one of them.  If they are both not
	there then it doesn't get this choice and you will get dead
	branchs as a result.

	Manditory to implement also applies to signing.  You havn't
	implemented if you are not using it.

	Mark
 
> -derek
> 
> Mark.Andrews@isc.org writes:
> 
> > > Counter argument is that having two algorithms means that one can be
> > > attacked via a break in either algorithm.
> > 
> > 	That is why the use of a particular algorithm MUST be
> > 	selectable at runtime both in the signer and resolver.  We
> > 	already have had to withdraw one algorithm.
> > 
> > > So, while I understand the desire to have a fallback strategy, I'm not
> > > sure that we really have one whether DSA is mandatory or not.
> > 
> > 	Well the choices are:
> > 	* Immediate replacement of all resolvers. 
> > 	* Immediate disabling of a algorithm and gradual replacement
> > 	  of all resolvers.
> > 
> > 	You will get *much* higher success with the second vs the first.
> > 
> > 	Mark
> > 
> > --
> > Mark Andrews, Internet Software Consortium
> > 1 Seymour St., Dundas Valley, NSW 2117, Australia
> > PHONE: +61 2 9871 4742                 INTERNET: Mark.Andrews@isc.org
> > 
> > --
> > to unsubscribe send a message to namedroppers-request@ops.ietf.org with
> > the word 'unsubscribe' in a single line as the message text body.
> > archive: <http://ops.ietf.org/lists/namedroppers/>
> 
> -- 
>        Derek Atkins
>        Computer and Internet Security Consultant
>        derek@ihtfp.com             www.ihtfp.com
> 
> --
> to unsubscribe send a message to namedroppers-request@ops.ietf.org with
> the word 'unsubscribe' in a single line as the message text body.
> archive: <http://ops.ietf.org/lists/namedroppers/>
--
Mark Andrews, Internet Software Consortium
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: Mark.Andrews@isc.org

--
to unsubscribe send a message to namedroppers-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>