3 ms·
That's part of the story. The root keys are RSA-2048, but the intermediary zone signing keys for the root are RSA-1024. The latter keys are changed every third
by xorcist 11y ago
That's part of the story. The root keys are RSA-2048, but the intermediary zone signing keys for the root are RSA-1024. The latter keys are changed every third month. So, while there is pressing need to move to larger key sizes, the short validity tends to lessen the impact somewhat.
There were some concerns that the larger keys could cause issues with some network equipment, but it looks like those concerns were overblown. Network engineers are a fairly conservative bunch and, perhaps contrary to your expectations, there are real systems in the real world that would break if the root zone broke. These systems tend not to be web, so they might not be as visible to an end user perhaps.
- tptacek 11y ago"Conservative" is not the word I would use about this decision.