shuque / draft-dnsop-multi-alg-rules Goto Github PK

Previous discussion:

https://github.com/peterthomassen/draft-thomassen-dnsop-multialgo/pull/1/files#r1264591261

Previous discussion:

https://github.com/peterthomassen/draft-thomassen-dnsop-multialgo/pull/1/files#r1264590496

https://www.ietf.org/archive/id/draft-hardaker-dnsop-intentionally-temporary-insec-01.html#name-transitioning-using-two-dns proposes that one might switch providers by including both in the NS RRset, then switching the DS record from old key to new key.

If the old and new algorithms aren't the same, resolvers will expect RRSIGs with the (one) advertised algorithm; if only another is received, resolvers will try another nameserver, so eventually an RRSIG with the advertised algorithm will be retrieved. This would be the case both before and after replacing the DS record.

When compared to a double-DS setup, this adds extra latency, but it enforces the security status associated with either advertised algorithm (unlike in case of the proposed multi-signer validation rules when both an old (unsupported) and a new algorithm are advertised). -- The practical security difference is little, but it requires just one DS update to complete the provider switch.

However: Do all resolvers really retry?

@hardaker