Ondrej Caletka - 2026-10-29 11:03:28
Are PQC algorithms resistant to private key being 4?
Shane Kerr - 2026-10-29 11:07:21
Joe's going to drink a lot of coffee if we are going to have a PQC-safe DNS!
Shane Kerr - 2026-10-29 11:09:26
As we always say, UDP servers are massively over-provisioned and TCP servers don't need to be as over-provisioned since they don't have to worry about spoofed source packets.
Shane Kerr - 2026-10-29 11:14:20
Not changing the specification, by declaring it local policy? Press F to doubt.
Ondrej Caletka - 2026-10-29 11:24:16
So basically the proposed change would mean there will be no supported algorithm rollover from PQC to a non-PQC algorithm without going insecure
Ondrej Caletka - 2026-10-29 11:25:48
This is general problem with DNS registries. I once tried to figure out which registry allows IDNs and under which conditions. It turned out to be a much harder task than just Google TLD name + IDN.
Shane Kerr - 2026-10-29 11:26:52
Which company does Jim Reid work for?
Ondrej Caletka - 2026-10-29 11:28:10
Some company called Scotland?
Shane Kerr - 2026-10-29 11:28:49
Anyway, the PQC to non-PQC roll can be done by changing the DS can't it? You still have to keep a KSK and signatures while waiting for the old DS to expire, but after that you should be non-PQC right?
Ondrej Caletka - 2026-10-29 11:29:51
Fair point, so only the double DS way is not possible. I think that is pretty OK then.
Ondrej Caletka - 2026-10-29 11:30:40
Attendee list says: rtfm llp
Shane Kerr - 2026-10-29 11:31:46
Thanks! I know Jim, I'm just annoyed that he refuses to follow the very sensible guidelines which state you are supposed to declare who you work for when speaking at a RIPE meeting. 😆
Shane Kerr - 2026-10-29 11:33:12
I think Joe has mentioned Vancouver a few times without mentioning what that means. There is a DNS OARC meeting next week in Vancouver.
Shane Kerr - 2026-10-29 11:36:08
DNS message format finds the very idea of consistent sizes to be offensive. 😉
Shane Kerr - 2026-10-29 11:36:32
I do like the 666 byte fixed size though. 😈
Shane Kerr - 2026-10-29 11:44:01
Thank for the explanation!
Shane Kerr - 2026-10-29 12:01:25
Very cool breakdown.
Shane Kerr - 2026-10-29 12:02:30
RBXFR?
Stephen Strowes - 2026-10-29 12:05:52
there are only two geographic regions
Shane Kerr - 2026-10-29 12:06:06
Nothing seems very big to Cloudflare though!
Victoria Risk - 2026-10-29 12:08:28
excellent point from Ulrich, APAC is a very different story
Shane Kerr - 2026-10-29 12:09:38
Except that DNS traffic is so small compared to actual traffic (it is mostly service discovery after all), that it still does not seem like a lot of traffic.
Ivan Garnizov - 2026-10-29 12:11:56
Is it possible to chain multiple of these IPv6 next hops for IPv4 routing based on RFC8950?
Ivan Garnizov - 2026-10-29 12:12:51
I suppose yes, but would be happy to get a confirmation
Ondrej Caletka - 2026-10-29 12:13:00
Yes, every network can implement RFC 8950 and get rid of IPv4 on the interconnect
Ondrej Caletka - 2026-10-29 12:13:28
Plus there is Remco's draft for doing this even on network-to-host side of the network
Willem Toorop - 2026-10-29 12:23:07
Thank you all!