Subject: draft-ietf-dnsext-dnssec-rsasha256 security considerations

From: Rob Austein <[email-masked]>
Date: Tue, 21 Mar 2006 12:15:46 -0600

draft-ietf-dnsext-dnssec-rsasha256-00.txt (a good and worthy draft)
needs security considerations text explaining why it's not vulnerable
to a downgrade attack.

To review: RRSIG RRs don't form RRsets, therefore one can't detect a
nogoodnik filtering out an RRSIG, so DNSSECbis has a rule requiring
every signed RRset to be signed with every algorithm listed in the
zone apex DNSKEY RRset.  This is "obvious" to anyone who has memorized
the DNSSECbis specifications, but it'd be kind to explain it (again)
for the benefit of other readers.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>