Re: NSEC version field (Re: NSEC2- and an Authenticated Denial Mechanism Flag)

[roy@dnss.ec]

Ed, Paul,

This 'downgrade attack' is FUD (technically its there, but its a
non-issue). How would we EVER use a new signing algorithm, currently not
in use, if the downgrade attack would be a problem ?

Unless folk upgrade V1 (nsec) resolvers to V2 (nsec2), they see V2 zones
as unsigned.

My point is:

V2 zones do not yet exist. Would-be V2 zones are unsigned now. When V2
zones exist, they will still be unsigned to V1 resolvers. Eventually V1
resolvers will upgrade to V2 resolvers.

Part of the upgrade curve.

What exactly is the problem ?

As an analogy.

DNSSEC zones do not yet exist. Would-be DNSSEC zones are unsigned now.
When DNSSEC zones exist, they will still be unsigned to LEGACY resolvers.
Eventually LEGACY resolvers will upgrade to DNSSEC resolvers.

Part of the upgrade curve.

Roy

--
to unsubscribe send a message to namedroppers-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>