Re: [dnsext] historal root keys for upgrade path?

[Paul Wouters <[e-mail]>]

On Mon, 31 Jan 2011, Brian Dickson wrote:

> Having read it, it appears that any new RZ KSK is pre-published and
> signed by the old KSK for about 50 days only.
>
> After that point in time, an old trust anchor would no longer be able
> to automagically validate the new KSK (5011 method).
>
> So, it appears that an automagic bootstrap method would have to rely
> on something other than the RZ KSK (or specifically its trust
> anchor/public key).
>
> The simplest bootstrap method would be to have a series of BSK
> (bootstrap keys), created on a periodic basis (every N years), and

I think the simplest method is the TALINK one described in Wouter's
draft. Keep the historic 5011 information in a special zone (and ignore
the expired RRSIGs in them)

I don't think we realistically can change the current root key management.

Paul