Virtualmin supports a flurry of algorithms for DNSSEC: RSASHA1, RSASHA256, RSAMD5, DSA, DH, HMAC-MD5(???), NSEC3RSASHA1, NSEC3DSA.
If I understand correctly, there's Proof of Concept available for SHA1 being easy to compromise when used with DKIM, because of data length. So that would lead me to believe that the same applies to DNSSEC.
Which key algorithms are most appropriate for use in DNSSEC with production environments?
And what supporting technical papers are available to substantiate the reasoning for the algorithm choice?
There's a balance to be found here however, the same one that INFOSEC so often must find, in choosing an appropriately secure algorithim without zealously draining resources in production environments.
Still, an appropriate algorithm for vital cyber systems (financial or sensitive personal information) might vary from one for mission-critical systems.
Or is the threat from man-in-the-middle attacks too great in a global cyber diaster event, such that the strongest cryptography is warranted even for mission-critical systems without highly sensitive information?