Re: [dnsext] Historical root keys: The Large Router Vendor Speaks

[John Bashinski <[e-mail]>]

On 2011-01-28 16:56, Thierry Moreau wrote:

> But once IANA (or whichever organization makes it "public") commits to
> "it" on a long term it becomes by definition more trustworthy than the
> root KSK.

How does that work? All validations are funneled through through the
root KSK. Furthermore, once you're bootstrapped, all your trust anchor
updates come as RFC 5011 signed by the root KSK. So there's no way to
have anything more trusted than the root KSK. This is in the technical
sense of "trusted", which is more or less equivalent to "able to spoil
your day".

The originally proposed form of "it" was for "it" to *be* the root
KSK. You'd start with a root KSK, and if that KSK were still in use,
you'd be done. If not, you'd get "it" in the form of a history of root
KSK rollovers, run through the chain, and thereafter anchor yourself at
the current root KSK.

I still prefer that approach, but other people seem to prefer
alternatives. Not even those the alternatives create anything that I can
see as "more trusted" than the root. "Equally trusted" at most.

> Then suddenly the trust foundation shifts from the root KSK
> to "it" and soon it becomes best practice to use it as the normal way
> to bootstrap DNSSEC resolution.

Well, it certainly wouldn't be the only available way, but, yes, it
probably would be the most common way.

What do you believe should be the "normal way"?

> Ah ah! Now "it" becomes the (default) new trust foundation. I knew it
> would come sooner than later.

In order to enable DNSSEC by default, it MUST be possible to bootstrap
it without human intervention, using only the information available to
you when you first get turned on. That's what "default" means.

The current default is not to use DNSSEC at all. A tiny minority
enables DNSSEC. That tiny minority would still be able to do whatever
it wanted to set up trust anchors... including what it's doing today.

So what's the alternative?

					-- jbash