Re: [dd] [Ext] DS pinning for secondaries

It sounds to me like this is related to the "sharedds" idea in https://github.com/fl1ger/deleg/blob/main/draft-dnsop-deleg-dnssec.md.  That idea definitely has some unsolved problems.  Supporting "untrusted delegations" is one of them, although it's not hard to fix by adding a "trusted" flag to the alias.  A harder problem, I suspect, is the compatibility with validating stubs: https://github.com/fl1ger/deleg/issues/42.

--Ben
________________________________
From: dd <dd-bounces@ietf.org> on behalf of Paul Hoffman <paul.hoffman@icann.org>
Sent: Tuesday, February 27, 2024 12:04 PM
To: Petr Špaček <pspacek@isc.org>
Cc: dd@ietf.org <dd@ietf.org>
Subject: Re: [dd] [Ext] DS pinning for secondaries

!-------------------------------------------------------------------|
  This Message Is From an External Sender

|-------------------------------------------------------------------!

On Feb 27, 2024, at 08:55, Petr Špaček <pspacek@isc.org> wrote:
>
> Today I've presented DELEG work to CENTR Tech group [1] and there was a request to support use-case where ALIAS points to secondaries who are supposed to serve signed version of the zone, but cannot resign it themselves.

That sounds like a good use case.

>
> In my mind that translates to syntax like this:
>
> signed.example.net. DELEG 0 operator.example. ds="12345678"

Why that, and not
   signed.example.net. DELEG 0 operator.example.
   signed.example.net. DS 32859 13 2 12345678
That is, the parent continues to publish the (signed) DS as normal, and operator.example just publishes the rest of the delegation information?

--Paul Hoffman
--
dd mailing list
dd@ietf.org
https://www.ietf.org/mailman/listinfo/dd