Re: [dnsext] historal root keys for upgrade path?

[Phillip Hallam-Baker <[e-mail]>]

On Wed, Jan 26, 2011 at 10:06 AM, Paul Wouters <[e-mail]> wrote:

> On Wed, 26 Jan 2011, Phillip Hallam-Baker wrote:
>
>  If you want to distribute keys for immediate use in the DNS, use the
>> infrastructure designed for that purpose.
>> If you want to perform long term trust root management, use an
>> architecture that is designed for that purpose.
>>
>> X.509v3 is designed to deal with TA keys that are valid for decades. There
>> is experience doing that. There is infrastructure that exists to perform
>> management of such keys in a high security environment. And it is possible
>> to outsource management of such to several providers and is is possible to
>> buy
>> the equipment to do so in-house.
>>
>
> Which CA(s)s would we have to make the products trust? IANA seems to
> be using Godaddy today. Is that guaranteed to last forever? If not,
> then how is a device supposed to know which CA IANA has chosen at some
> time in the future? Do we just have to trust all 1500+ commercial CA? And
> deal with all the revocations? And how to install new ones, using
> what trust? And remember, this is a switch or router, not a browser or
> an OS with the "update now" button.
>


Use a Quorate Root then.

Multiple Signers, are recognized. A valid key must be counter signed by a
quorum of the recognized signers.

This approach is unencumbered as far as I know (Phil Z. described it at
length but did not deploy code).


As Ed Lewis points out, these are really tricky trust problems and there are
good reasons not to want to trust any monolithic single rooted scheme.

There are much larger International IT efforts than DNSSEC that have
collapsed due to failure to agree on this type of issue.

-- 
Website: http://hallambaker.com/