Subject: Re: DNSSEC-RECORDS ISSUE: DSA from Mandatory to Optional

From: Jim Reid <[email-masked]>
Date: Wed, 24 Sep 2003 20:51:36 +0100

I agree with Michael. It would be prudent to have a second algorithm
as a safety net. No SPoFs and all that. Even though a vulnerability in
RSA looks unlikely and DNSSEC wouldn't be top of the list of things to
worry about if that happened.

I'd prefer the draft to use 2119 language: MUST, SHOULD, MAY and so
on. OPTIONAL is too fluffy.

Count this as another vote for a SHOULD for DSA.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Fearghas McKay <[email-masked]>
Date: Wed, 24 Sep 2003 23:03:29 +0200

>Count this as another vote for a SHOULD for DSA.

Count this as a another vote for SHOULD.

Thanks

	f

---

From: "D. J. Bernstein" <[email-masked]>
Date: 26 Sep 2003 01:29:00 -0000

Jim Reid writes:
> It would be prudent to have a second algorithm as a safety net. No
> SPoFs and all that.

Let me see if I understand how you imagine this ``safety net'' working.

Users sign their records with, say, 768-bit RSA. Someone announces a
768-bit RSA factorization. Users decide to change their keys to, say,
768-bit DSA. Right?

If so, you've now created massive verification failures. Verifiers that
don't support DSA will automatically disable all security, allowing the
records to be forged by any sniffing (or persistent blind) attacker at
far less cost than breaking another 768-bit RSA key.

In short, users are _losing_ security in this situation, unless DSA is
MANDATORY. It doesn't make sense to have an optional backup algorithm.
The only reasonable possibilities are mandatory DSA or no DSA at all.
This seems to be yet another example of ``SHOULD'' meaning ``The authors
of this document didn't think through the protocol.''

Furthermore---I'll put on my cryptographer's hat for a moment---current
methods are going to break 768-bit DSA not long after they break 768-bit
RSA. Modern ``combination-of-congruence'' factoring methods can be
adapted to compute discrete logarithms at almost the same speed. Using
both RSA and DSA is a waste of implementor time that could be better
used for, say, implementing RSA signature compression.

---D. J. Bernstein, Associate Professor, Department of Mathematics,
Statistics, and Computer Science, University of Illinois at Chicago