Re: Signature at parent (draft-ietf-dnsop-parent-sig-00.txt)

[[e-mail] (Ted Lindgreen)]

[Quoting John Gilmore, on Apr  6, 14:12, in "Re: Signature at par ..."]

> There's nothing wrong with putting an IPSEC KEY record at the top
> of a zone, along with the zone keys.

The problems with it are:

1. Inflexibility:
    Any change, update, addition, or removal of such a KEY
    needs the involvement of the parent.
2. Cost:
    It will be pretty likely, that TLDs will charge for signing KEYs,
    and probably more when lots of non-zone-KEYs are involved.
3. Liability:
    He, who signs, must make sure that he knows he is signing, and
    must accept some responsibility for it (otherwise the signature
    is worthless). I think a TLD should accept the responsibility for
    a proper delegation of a domain, but I don't think the TLD will
    accept the responsibility for local stuff like IPSEC-KEYS under
    those already delegated domains.

I think that smart zone-administrators keep their local KEYs out of
the apex' KEYset.

But some education may help to get them smart.

So, the question is: in a to be written "Best Current Practice
document" should we be silent about this, or just make a note or
remark, or discourage it, or make it a SHOULD NOT, or perhaps even
a MUST NOT?

I agree with Brian Wellington, that a "SHOULD NOT" will do fine.

Regards,
-- Ted.



to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.