Re: [dnsext] historal root keys for upgrade path?

[Phillip Hallam-Baker <[e-mail]>]

On Mon, Jan 31, 2011 at 12:21 AM, Brian Dickson <
[e-mail]> wrote:

>
> HOWEVER, and this is important, requiring TWO trust anchors of equal
> strength (same algorithm, same number of bits) to BOTH chain-validate
> the current root key properly as part of the bootstrap, where one of
> those is a previous root key, has some distinct advantages:
> - two keys (at least) would need to be compromised to compromise the target
> - the possible compromise of a root key, followed by rolling the key,
> means that the risk from following 5011 with that key, is only a
> problem if the other bootstrap key is also compromised
> - the value of compromising just the other bootstrap key is nearly
> zero, since that is necessary but not sufficient to compromise the
> target - thus limiting the value of this effort dramatically
> ----> having one trust anchor only (which is not based on the root
> key) does NOT have this benefit
> - minimizing the window of opportunity for attack (a one-time-only
> affair) further limits the value, and consequently lowers the
> likelihood of even an attempt being made
>

I think it would be a good idea to have a separate chain of trust in this
instance.

ICANN has reserved the right to roll the root and according to one post
requires the ability to do so at 60 days notice. To me that says that ICANN
does not want to be the ultimate root of trust for everything on the
Internet. They would be very ill advised to change that decision.

The main challenge in setting up an alternative chain would be to find a
party willing to run it that everyone involved can trust. Which is probably
impossible.


My view is that any ultimate root of trust would have to have a multiple
signer configuration and would have to be available for more than just one
technology. The cost of doing such a root right would be considerable. Using
it for DNS alone would be a waste.

Besides DNS there are many other critical roots that are at issue. Device
authentication for example, there is a similar issue with RFID.

Running such schemes becomes complicated because they end up hitting
government security concerns. If every electronic device requires an
identifier issued by a single entity under the control of one government,
other governments wonder if that might be used as a weapon in a trade
dispute.

-- 
Website: http://hallambaker.com/