| ▲ | GoblinSlayer an hour ago | |
They can be deprecated for confidentiality purpose, but DNSSEC doesn't use confidentiality. | ||
| ▲ | tptacek an hour ago | parent [-] | |
You're trying to argue that DNSSEC isn't exposed to HNDL attacks, so can use signature algorithms that CRQCs break. But that's neither here nor there: the approaching cryptographic research consensus is going to deprecate all ECC (and all RSA); yes, signatures aren't the priority for immediate removal, but nobody is recommending ECC signatures. The point is all this is happening just as ECC in DNSSEC may finally be stabilizing. | ||