Re: [dnsext] historal root keys for upgrade path?

[Phillip Hallam-Baker <[e-mail]>]

On Tue, Feb 1, 2011 at 2:14 PM, Tony Finch <[e-mail]> wrote:

> On Mon, 31 Jan 2011, Phillip Hallam-Baker wrote:
> >
> > ICANN can eliminate the problem of rollovers for scheduled rolls by
> > announcing that it will never roll the key except in an emergency.
>
> The problem with that idea is that (per Cisco's plan) if every
> Internet-connected device is a validator, an emergency will break the
> entire Internet. You *have* to plan for root key rollovers to be normal
> events that can be handled without fuss.


If you want to plan effectively for an emergency you have to do much more
than just roll the key.

The design of commercial PKI roots has been predicated on the need to make
them tamper-evident and not to eliminate the possibility  of a compromise.

If we ever did have to do an emergency roll we would probably need to change
the whole signing scheme as well. We would at a minimum need to go for a
stronger key but we might well have to go to a different algorithm.




> > We faced this problem in the PKI world and found that 20 year roots were
> a
> > better solution.
>
> But in the PKI world you have many trust anchors which can come and go as
> time passes without breaking the whole system.


Actually the number of roots is much smaller than people imagine. In the
case of Windows the ultimate root that matters is held by Microsoft and
always has been. That is the root used to sign the CTL that authorizes the
roots.

I believe that new CTL keys are introduced from time to time. But a given
root is good for the support lifetime of the product in question and in
practice has been maintained beyond that point.

And as certain people keep pointing out, as currently configured, each root
provides a fresh opportunity to compromise the system. That is the issue CAA
is designed to address.


-- 
Website: http://hallambaker.com/