Greetings. I like the idea of relaxing the "every algorithm must sign every RR" requirement from 4035/6840 in order to allow different KSK and ZSK algorithms, and to pre-populate. However, the rest of draft-huque-dnsop-multi-alg-rules feels wrong. The "UNIVERSAL" and "FORMERLY-UNIVERSAL" designations will tie DNSOP in knots for years, particularly with the introduction of post-quantum cryptography signatures. The document is wordy and at the same time mushy about the requirements. It is not clear where the use cases stop and the changes begin.
I am against adopting draft-huque-dnsop-multi-alg-rules but would be in favor of a much shorter document that has just the necessary changes to RFC 4035/6480 to allow both the multi-signer model and new algorithms that are only partially supported by validators. I would be willing to help write such a small document. --Paul Hoffman _______________________________________________ DNSOP mailing list -- [email protected] To unsubscribe send an email to [email protected]
