- More descriptive text for 'harden-algo-downgrade'.

diff --git a/doc/Changelog b/doc/Changelog
index 5372bcc9b08ec762b0532d87a7707449036d55eb..5f0ae73dbc4ee14b09091037c94aba6cb5296f3e 100644 (file)
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,3 +1,6 @@
+8 November 2024: Yorgos
+       - More descriptive text for 'harden-algo-downgrade'.
+
 6 November 2024: Yorgos
        - Increase the default of max-global-quota to 200 from 128 after
          operational feedback. Still keeping the possible amplification

diff --git a/doc/example.conf.in b/doc/example.conf.in
index 207fa33c6f9c317c67c57b56ac242a553a36eb08..55fea6a420be396152310defc55e5299875138e7 100644 (file)
--- a/doc/example.conf.in
+++ b/doc/example.conf.in
@@ -556,8 +556,9 @@ server:
        # harden-referral-path: no
 
        # Harden against algorithm downgrade when multiple algorithms are
-       # advertised in the DS record.  If no, allows the weakest algorithm
-       # to validate the zone.
+       # advertised in the DS record.  If no, allows any algorithm
+       # to validate the zone which is the standard behavior for validators.
+       # Check the manpage for detailed information.
        # harden-algo-downgrade: no
 
        # Harden against unknown records in the authority section and the

diff --git a/doc/unbound.conf.5.in b/doc/unbound.conf.5.in
index 944a57c5bf620118cfbcdb1fcc051e059ef43274..159afc673bd0e7d7c94d5d668618ed278ef8ed33 100644 (file)
--- a/doc/unbound.conf.5.in
+++ b/doc/unbound.conf.5.in
@@ -1106,10 +1106,23 @@ to increase the max depth that is checked to.
 .TP
 .B harden\-algo\-downgrade: \fI<yes or no>
 Harden against algorithm downgrade when multiple algorithms are
-advertised in the DS record.  If no, allows the weakest algorithm to
-validate the zone.  Default is no.  Zone signers must produce zones
-that allow this feature to work, but sometimes they do not, and turning
-this option off avoids that validation failure.
+advertised in the DS record.
+This works by first choosing only the strongest DS digest type as per RFC 4509
+(Unbound treats the highest algorithm as the strongest) and then
+expecting signatures from all the advertised signing algorithms from the chosen
+DS(es) to be present.
+If no, allows any algorithm to validate the zone.
+Default is no.
+RFC 6840 mandates that zone signers must produce zones signed with all
+advertised algorithms, but sometimes they do not.
+RFC 6840 also clarifies that this requirement is not for validators and
+validators should accept any single valid path.
+It should thus be explicitly noted that this option violates RFC 6840 for
+DNSSEC validation and should only be used to perform a signature
+completeness test to support troubleshooting.
+Using this option may break DNSSEC resolution with non-RFC6840-conforming
+signers and/or in multi-signer configurations that don't send all the
+advertised signatures.
 .TP
 .B harden\-unknown\-additional: \fI<yes or no>
 Harden against unknown records in the authority section and additional