Subject: Re: Q2: crypto algorithm requirements for DNSSEC

From: Jim Reid <[email-masked]>
Date: Thu, 13 Feb 2003 04:03:02 -0800

>>>>> "Jakob" == Jakob Schlyter <[email-masked]> writes:

    >> I'm not sure what the answer should be, but I don't think a TLD
    >> will ever want to support two different algorithms in a zone,

    Jakob> why? due to zone size constraints? I do not agree.

Well zone size is one consideration. Another would be the extra time
and resources needed to sign the same data with different algorithms.
What would be the justification for all that extra overhead? The case
for multiple algorithms is not clear, at least not to me. Having just
one algorithm would be a SPoF. OTOH it would keep things simple for
signing and verifying => making deployment more straightforward. And
ISTR from cryptography 101 class that it's usually not a good idea to
encrypt or sign the same stuff with different keys or algorithms.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Paul Vixie <[email-masked]>
Date: Thu, 13 Feb 2003 21:00:25 +0000

> I wouldn't consider the resources used for signing a problem with modern
> hardware - people sign .com with their desktop machine within reasonable
> time.

s/desktop/laptop/, but otherwise agreed.