Re: Q2: crypto algorithm requirements for DNSSEC

[Greg Hudson <ghudson@MIT.EDU>]

On Wed, 2003-02-12 at 00:35, David Blacka wrote:
> But from the zone owner's perspective, his zone will be vulnerable until 
> either he re-signs the zone or all resolvers are reconfigured to not use the 
> bad algorithm.

I don't see how re-signing the zone helps.  If I can forge, say, RSA
signatures, then I can forge a signature chain all the way from the
client's pre-configured RSA public key to the domain I'm trying to
attack, whether or not the real zone data has been re-signed with a DSA
key.


--
to unsubscribe send a message to namedroppers-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>