Re: [dhcwg] [ntpwg] Fwd: New Version Notification for draft-ogud-dhc-udp-time-option-01.txt

[Mark Andrews <[e-mail]>]

In message <[e-mail]>, Mark Andrews writes:
> 
> The inception and expiration times in RRSIGs is specified as seconds
> since 00:00:00 Jan 1 1970 UTC excluding leap seconds modulo 2^32.
> 
> There are no recommended fudge factors to use when evaluating these
> times though named sets the expire time to 3600 seconds in the past

That should read "inception time to 3600 seconds in the past"

> by default when generating RRSIGs.  I believe the other signers do
> similar.  I've considered making the inception timestamp a whole
> day in the past to cope with badly set timezones.
> 
> The signature validity intervals are on the order of days.  Named
> defaults to 30 days.  They are regenerated about a week before they
> are due expire if not already regenerated due to zone content
> changes.  The records should expire from caches before they become
> invalid if re-signing is being done properly.
> 
> So if the validator and the signer are both within 30 minutes of
> the true time validation should succeed.
> 
> Mark
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: [phone]                 INTERNET: [e-mail]