Ed25519 for DNSSEC
This sounds interesting but really isn&#x27;t.<p>Think about it for a second and you&#x27;ll realize that <i>specifying</i> a modern signature scheme for DNSSEC is trivial. The best modern signature schemes are designed to be easy to adopt!<p>The problem is that none of the installed DNSSEC base groks ed25519. It took years to get P-curve DNSSEC --- which virtually nobody uses --- to the point where its mere presence didn&#x27;t break resolvers. It would probably take something on the order of 10 years of concerted effort to get 95%+ of active resolvers to grok ed25519, and during that time everyone who wanted secure signatures would need to sign both with RSA and with ed25519, and for 10 years <i>after that</i> we&#x27;d be dealing with people keeping insecure RSA signatures around out of compat concerns, and then comes the Usenix papers about downgrade attacks, and at night the ice weasels come, just like anyone who&#x27;s dealt seriously with TLS will tell you.<p>What&#x27;s especially irritating about this situation is that we <i>know</i> the signature scheme used in &quot;mainstream&quot; DNSSEC is inferior to modern curve signatures, and we know virtually none of the DNSSEC software being deployed can grok modern curve signatures, and we know this is an upgrade that needs to happen lest we get a whole crapload of new 1990s crypto deployed across the Internet, and still DNSSEC advocates are pushing for more deployment of this stuff.<p>Nobody uses DNSSEC right now. If the root private keys were dumped to Pastebin right now, to a pretty good first approximation not one commercial operator on the Internet would need to send out a breach warning to customers. We should all be taking a breath and reconsidering the protocol and its implementation details.<p>This, of course, isn&#x27;t all that&#x27;s wrong with DNSSEC. Google [against dnssec].