bemasc / dnssec-strict-mode Goto Github PK

Section 2.2:

Under the current DNSSEC validation behavior, a zone is only as secure as the weakest algorithm implemented by both the signer and the validator.

When talking about signed zones, I prefer talking about how the zone is signed, not what the signer supports. so "algorithm used to sign the zone".

"If this flag is set, all records in the zone MUST be signed correctly under this key's specified Algorithm." is redundant - that's the same as the current rules.

document in the op considerations section: As with roll-in, when moving away from a strict mode alg, a zone operator must first roll to (all) non-strict-mode keys of that algorithm, then roll the alg out.

If there are multiple Strict Mode keys for the zone, validators SHOULD validate signatures under each of their Algorithms.

First, I assume you mean "Strict Mode keys for multiple algorithms".

I think you should go on to say "...and mark the RRset as Bogus if ANY of those validations result in a Bogus result".

(And, as I said on the dnsop list, I don't think we need to make this change. But if we are...)

Please deal with the edge case of a DNSKEY RRset where (at least) one DNSKEY of algorithm X has the bit set and (at least) one does not.