1.1.1.1 supports ML-DSA-44 (alg 18)

[Bas Westerbaan]

Hey all!

Yesterday we rolled out support for ML-DSA-44 (alg 18) in 1.1.1.1 turned on
by default. We also insist on alg 18 signatures if an alg 18 key is
advertised in a DS (even if other algorithms are available) to prevent
future downgrades.

dig @1.1.1.1 +dnssec only.alg18.westerbaan.name
dig @1.1.1.1 +dnssec downgrade.alg18.westerbaan.name

This all of course doesn't make any difference today as there basically
aren't any alg 18 signed zones yet except for the odd test zone.

Best,

 Bas
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.dns-oarc.net/pipermail/dns-operations/attachments/20260901/c073a95a/attachment.html>