23 Čec
2021
23 Čec
'21
16:28
Hello.
On 23/07/2021 16.13, Schindler, Stefan wrote:
Because for some reason a lot of ISP resolvers support
RSA only while
I would like to future-proof my zone with ED25519 at the same time.
As the current DNSSEC standards go, I think it's normally not worth
using two algorithms at once on a single zone (except temporarily when
changing from one to another). Validators will succeed when validation
with *any* of the algorithms succeeds. Therefore adding a stronger algo
won't make the result stronger (attackers can choose which one to
compromise) - at least until the weaker algo gets (commonly) considered
as insecure.
Weirdly enough, DNSSEC validators do not do that even with short RSAs -
one problem is that standardized (non-)support mechanism is independent
of key length. That's OK for the new fixed-length algos but not so much
for RSA.
--Vladimir | knot-resolver.cz