Re: DNSSECbis Q-2: degradation attack

[Paul Vixie <paul@vix.com>]

>     I am not yet convinced this needs fixing now; pointing to this
>     issue in the protocol doc security section may be sufficient. What
>     do others think?

i think that if we're not going to specify an alg rollover process, or
the interaction when parents/children/resolvers only share a subset of
algs, then we should remove the algid field and just laminate RSA for
all time and assume that we will change port numbers if RSA is cracked.

to that end, i would be an objector during WGLC if this isn't resolved.

--
to unsubscribe send a message to namedroppers-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>