Re: weiler-dnssec-dlv-02

[Thierry Moreau <[e-mail]>]

David Conrad wrote:

> Hi,
> 
> 
>> and strong security around the KSK,
> 
> 
> Not specified in the draft, but define "strong".  IANA already has  some 
> level of security, but I suspect nothing on the order of what  would be 
> necessary to provide a sufficient level of assurance that  the KSK 
> wasn't compromised.  Since the data we're talking about here  are used 
> to sign information that relates to national interests, I  suspect the 
> level of security necessary is on the order of that  necessary to 
> protect national-level secrets.  I don't plan on moving  IANA to a 
> former ICBM silo.
> 
> In my mind, this sort of points out a bit of a flaw in the  operational 
> implications of DNSSEC.  Forget (as we have to date since  it is a hard 
> problem) how one might recover from a root KSK  compromise.  
> Pragmatically speaking, the holder of the root KSK is  setting itself up 
> to be a teensy bit of a target.  Compromise of the  root KSK would have 
> ... significant implications and likely  astounding liabilities.  Who 
> wants that?  Since the implications are  so great (and there is no way 
> to recover), you have to be _EXTREMELY_  careful with the key.  This 
> level of care is likely to be is very,  very expensive.  Who is going to 
> pay for that?
> 

Thanks David for re-stating the requirement for emergency KSK rollover 
requirement.

However, the KSK security strength was not particularly stressed in the 
trust anchor (TA) automated rollover requirements draft that the DNSEXT 
produced, at least not with the above pragmatic perspective. The DNSEXT 
wg has moved this draft to the IESG, so it looks like a done deal for 
the wg.

In the early days of TA rollover requirements discussions, I used to 
advocate for the expliciteness of emergency rollover recovery 
principles, with an implied "catastrophic failure mode" disclosure 
requirement. I.e. let's disclose the exact circumstances where "there is 
no way to recover", so that _EXTREME_ _CARE_ could be applied to these 
circumstances.

But the wg paid more attention to other requirements and selection 
criteria. Overall, I came to the conclusion that the TA rollover issue 
hit a limit in what an IETF wg can realistically achieve.

Regards,

-- 

- Thierry Moreau

CONNOTECH Experts-conseils inc.
9130 Place de Montgolfier
Montreal, Qc
Canada   H2M 2A1

Tel.: [phone]
Fax:  [phone]

web site: http://www.connotech.com
e-mail: [e-mail]


--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>