Weekend Reads

[jtk@infosec.exchange]

Weekend Reads

* Post-quantum RPKI framework
https://arxiv.org/abs/2603.06968
* DNSSEC negative trust anchors
https://quad9.net/news/blog/dnssec-ntas-no-good-compromises/
* AS112 deployment characteristics
https://0x03c0.com/files/pam26-as112-camera-ready-with-notice.pdf
* Geoff Huston on Internet timekeeping
https://www.potaroo.net/ispcol/2026-03/nts.html
* Measuring IX route servers prefix coverage
https://blog.benjojo.co.uk/post/how-far-can-you-get-with-ix-route-servers

#RPKI #DNSSEC #DNS #NTP #BGP

[paul_ipv6@infosec.exchange]

@jtk

i like the aspiration of eliminating use of negative trust anchors in DNSSEC but with the gutting of so much govt/mil related staff, and since .mil/.gov and NASA have been the biggest drivers of use of NTAs, i'm a wee bit skeptical that this will not result in lots of user complaints for large resolver populations.

[jtk@infosec.exchange]

@paul_ipv6 Working on finally finishing up a paper related to this, but suffice to say I think Quad9 is taking a very reasonable position here.

There continues to be interesting DNSSEC-related outages, even "impactful" ones, but I think one could argue NTA getting it wrong is at least as risky as an outage. Hmm.. maybe something for future work .