Hacker News new | ask | show | jobs
by ognyankulev 590 days ago
I was hoping it's NIST ECDSA P-256 (algo 13) for smaller DNS packets, instead of what they did with continuing with RSA 2048 (algo 8).
2 comments

Most of the big TLDs have already converted to algo 13 -- .org is still lingering on algo 8, but .com, .net, .edu, .gov have all converted, so a lot of the DNS traffic is using smaller signatures already.

Changing the algorithm for the root is being studied - see for instance https://lists.icann.org/hyperkitty/list/ksk-rollover@icann.o... ; I wouldn't be surprised to see an algo change as part of the next root key rollover.

My guess is they did that to be compatible with FIPS 140-2.

FIPS 140-3 allows ECDSA, but isn't widely deployed yet (among sites required to comply), so using ECDSA would probably cause issues for government organizations that need to use FIPS and DNSSEC.

Nah. Changing algorithms is a bigger deal than rolling the key. They want the make sure rolling the key is a non-event before taking on changing algs. Changing the algorithm is being discussed however.