Re: [dnsext] historal root keys for upgrade path?

[Paul Hoffman <[e-mail]>]

On 1/25/11 12:12 PM, Paul Wouters wrote:
> On Tue, 25 Jan 2011, Paul Hoffman wrote:
>
>>> Is something like this even possible? I'm not sure what happens to the
>>> root private keys once they are retired...
>>
>> It is possible, but not in the way you seem to be thinking. If you
>> trusted that hardware/software vendor to securely populate your trust
>> anchor store originally, you can trust them to do so in the future as
>> well.
>
> Well, this is the vendor asking "do we really need to build something
> ourselves"
>
> The anser seems to be "yes". It also means that some devices will fail
> due to
> firewall rules if this updating happens outside of the DNS scope.

I don't understand this. I proposed that the updating procedure use 
fixed IP addresses; are you saying that there are firewalls that prevent 
such communication unless there was a DNS lookup first?

>> Bootstrapping is hard, but once you have done it, you can reuse the
>> trust logic you used to do it again.
>
> Not neccessarilly. Bootstreap happens on a desk at the sysadmin office, not
> neccessarilly on the switch in the production environment....

There is no reason why it can't happen at the switch itself, assuming 
that you have not turned off the "trust the vendor to bootstrap DNSSEC" 
option in the switch's config.