That's your comeback? "You're wrong, the RSA-1024 is only temporary, and only used at the root of the tree"?

The prosecution rests.

If you read the "Deployment Schedule" in that second link, you'll see "Sept. 20 [2016]: The first 2048-bit ZSK will be pre-published in the root zone."

Looks like the prosecution might only have a few weeks of rest. :)

It's the second half of 2016 and the best argument you have for DNSSEC is that they've at least scheduled the start of the removal of 1024 bit RSA keys for later in the year.

I'm pretty comfortable with what this thread says about our respective credibility.

That's great, but if you really wanted to clear up any doubt about your credibility, could you provide an estimate for how much it would cost an adversary to crack a 1024 bit RSA key within 90 days? You seem to suggest that's a significant threat that has to be addressed before anyone uses DNSSEC.

There isn't any doubt about tptacek's credibility.

He points out how dnssec puts control in the hands of whatever government controls the domain, and your counter argument is about the strength of keys used to do so.

It makes your argument seem less like an argument on the merits of the issue and whether or not tptacek is a credible voice in the matter. Further, to call his arguments FUD takes you further down a path that is not increasing your own credibility.

The question of whether DNSSEC "puts control in the hands of whatever government controls the domain" was addressed in the first link I sent:

http://blog.easydns.org/2015/08/06/for-dnssec/#government http://blog.easydns.org/2015/08/06/for-dnssec/#dane

Basically, whereas any CA (controlled by any government) can issue a certificate for any domain, with DNSSEC you at least get to pick which government you trust to secure your domain (or run your own generic TLD and not trust any government).

My counter argument about the strength of the keys was because he was the first to mention "1024 bit RSA". Did you miss that?

Finally, I used the term "FUD" to borrow the language from that EasyDNS article, the second sentence of which is: "Sadly, there is a lot of FUD out there and we wanted to both debunk that FUD and explain why DNSSEC is vital to the security of the internet." Hopefully people are reading both sides of the story here.