IETF Logo Mail Archive

Re: [dnsext] historal root keys for upgrade path?

Paul Wouters <paul@xelerance.com> Thu, 27 January 2011 20:58 UTC

Return-Path: <paul@xelerance.com>
X-Original-To: dnsext@core3.amsl.com
Delivered-To: dnsext@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 178CC3A6A6A for <dnsext@core3.amsl.com>; Thu, 27 Jan 2011 12:58:39 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.574
X-Spam-Level:
X-Spam-Status: No, score=-2.574 tagged_above=-999 required=5 tests=[AWL=0.025, BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rSbZD5qJc62k for <dnsext@core3.amsl.com>; Thu, 27 Jan 2011 12:58:38 -0800 (PST)
Received: from newtla.xelerance.com (newtla.xelerance.com [193.110.157.143]) by core3.amsl.com (Postfix) with ESMTP id 1207A3A6A5E for <dnsext@ietf.org>; Thu, 27 Jan 2011 12:58:38 -0800 (PST)
Received: from tla.xelerance.com (tla.xelerance.com [193.110.157.130]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by newtla.xelerance.com (Postfix) with ESMTP id B30D8C522; Thu, 27 Jan 2011 16:01:41 -0500 (EST)
Date: Thu, 27 Jan 2011 16:01:41 -0500
From: Paul Wouters <paul@xelerance.com>
To: Brian Dickson <brian.peter.dickson@gmail.com>
In-Reply-To: <AANLkTi=UuejsF29sD6cDQ_a8G88WDy7FZSibFPysOPn0@mail.gmail.com>
Message-ID: <alpine.LFD.1.10.1101271600080.24608@newtla.xelerance.com>
References: <alpine.LFD.1.10.1101251250040.30991@newtla.xelerance.com> <4D3F233C.7000900@vpnc.org> <alpine.LFD.1.10.1101251510140.30991@newtla.xelerance.com> <alpine.LSU.2.00.1101261442120.3329@hermes-1.csi.cam.ac.uk> <AANLkTinCB-d2HWGY4kSOmfSCMNQ-D61keEE+1poTu11g@mail.gmail.com> <alpine.LFD.1.10.1101260958490.30991@newtla.xelerance.com> <82vd1amfjm.fsf@mid.bfk.de> <AANLkTi=eOGd0Ce0ei-c_MysqbHpp7NUWFPc-xCpt=muq@mail.gmail.com> <AANLkTimiaL-eSWSAEfsDqjgZsSuU5HfkMyM2uP5v34za@mail.gmail.com> <alpine.LFD.1.10.1101271523100.24608@newtla.xelerance.com> <AANLkTi=UuejsF29sD6cDQ_a8G88WDy7FZSibFPysOPn0@mail.gmail.com>
User-Agent: Alpine 1.10 (LFD 962 2008-03-14)
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset="US-ASCII"; format="flowed"
Cc: dnsext@ietf.org
Subject: Re: [dnsext] historal root keys for upgrade path?
X-BeenThere: dnsext@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: DNS Extensions working group discussion list <dnsext.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/dnsext>, <mailto:dnsext-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/dnsext>
List-Post: <mailto:dnsext@ietf.org>
List-Help: <mailto:dnsext-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsext>, <mailto:dnsext-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 27 Jan 2011 20:58:39 -0000

On Thu, 27 Jan 2011, Brian Dickson wrote:

>> Now you have just moved the problem. I need this DNSKEY as trust anchor. How
>> do I know this will not be rolled and how to I get historic data on this
>> key.
>
> Sorry, I thought that was obvious... This DNS zone (or these zones)
> would need to be maintained, actively, by $vendor.

The idea (or hope) was that we could do something once, instead of each vendor
having to do it for themselves. also if vendors die or merge, these zones could
die while the equipment is otherwise still fine to use.

If the vendor is active and alive and the product not EOL, then you could just
integrate it with a firmware ugprade (though this might be hard in the field)

Paul

v2.23.0 | Report a Bug | By Email