Re: [dnsext] historal root keys for upgrade path?

[Brian Dickson <[e-mail]>]

On Thu, Jan 27, 2011 at 1:49 PM, Brian Dickson
<[e-mail]> wrote:
> On Thu, Jan 27, 2011 at 1:18 PM, Florian Weimer <[e-mail]> wrote:
>> * Paul Wouters:
>>
>>> Remember this has to work on a product that has just been factory
>>> defaulted to a config from 10 years ago, and the device is EOL with
>>> no firmware upgrades.
>>
>> Why?  Where does this requirement come from?
>
> Regardless of oversimplification, having $vendor ship all routers with
> DNSSEC not only supported, but enabled by default, should be
> commended.

BTW, the reason we should consider this a really big win, is the
following observation for use cases:

(1) $Enterprise deploys new $router or $switch in their infrastructure
(2) $router/$switch has DNSSEC configured on by default, and
presumably successfully bootstraps its valid root trust anchor
(3) $Enterprise configures DHCP on $router/$switch, using
$router/$switch as the validating (non-stub?) resolver
(4) $Enterprise desktops use physically-secure infrastructure to the
resolver, which does validated DNSSEC resolution. Note that $desktop
does not strictly need DNSSEC.
(5) #WIN

Brian