IETF Logo Mail Archive

Re: [dnsext] historal root keys for upgrade path?

"Stephan Lagerholm" <stephan.lagerholm@secure64.com> Tue, 25 January 2011 17:59 UTC

Return-Path: <stephan.lagerholm@secure64.com>
X-Original-To: dnsext@core3.amsl.com
Delivered-To: dnsext@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id AB9523A687A for <dnsext@core3.amsl.com>; Tue, 25 Jan 2011 09:59:05 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -0.306
X-Spam-Level:
X-Spam-Status: No, score=-0.306 tagged_above=-999 required=5 tests=[AWL=0.189, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5fEWaSKA2xvP for <dnsext@core3.amsl.com>; Tue, 25 Jan 2011 09:59:04 -0800 (PST)
Received: from zimbra.secure64.com (unknown [64.92.221.189]) by core3.amsl.com (Postfix) with ESMTP id 1A2CF3A683E for <dnsext@ietf.org>; Tue, 25 Jan 2011 09:59:04 -0800 (PST)
Received: from localhost (localhost.localdomain [127.0.0.1]) by zimbra.secure64.com (Postfix) with ESMTP id 84AC5B8318; Tue, 25 Jan 2011 10:56:58 -0700 (MST)
X-Virus-Scanned: amavisd-new at secure64.com
Received: from zimbra.secure64.com ([127.0.0.1]) by localhost (zimbra.secure64.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LDXsJBIHppcG; Tue, 25 Jan 2011 10:56:58 -0700 (MST)
Received: from exchange.secure64.com (exchange.secure64.com [192.168.254.250]) by zimbra.secure64.com (Postfix) with ESMTPSA id 06593B82D0; Tue, 25 Jan 2011 10:56:58 -0700 (MST)
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=secure64.com; s=2010; t=1295978218; bh=LIzLcyKxiCwH7EokpvecLRdqehKbmkdAcyUPfn3g0nM=; h=MIME-Version:Content-Type:Content-Transfer-Encoding:Subject:Date: Message-ID:In-Reply-To:References:From:To; b=f+c+reVSxfgk62748gMhu xiy3Zz0EZE8jkrLLYXZqwMOwvCUrA2jHFIIJw2eJ4DqMzZTf2jCq6iGFbaneT1om57d b0xUovJjer2VwvCT8amqvktxEJVHFchwRqlftMOD4jpB94K+3+PS5iXm0n4KLzeyS9m WiHixpM6Va7mbbbQ=
X-MimeOLE: Produced By Microsoft Exchange V6.5
Content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Date: Tue, 25 Jan 2011 11:01:58 -0700
Message-ID: <DD056A31A84CFC4AB501BD56D1E14BBB96B061@exchange.secure64.com>
In-Reply-To: <alpine.LFD.1.10.1101251250040.30991@newtla.xelerance.com>
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
Thread-Topic: [dnsext] historal root keys for upgrade path?
Thread-Index: Acu8uKFlHXAvzR3bSr+5dw+T1d7IAwAARHGg
References: <alpine.LFD.1.10.1101251250040.30991@newtla.xelerance.com>
From: Stephan Lagerholm <stephan.lagerholm@secure64.com>
To: Paul Wouters <paul@xelerance.com>, dnsext List <dnsext@ietf.org>
Subject: Re: [dnsext] historal root keys for upgrade path?
X-BeenThere: dnsext@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: DNS Extensions working group discussion list <dnsext.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/dnsext>, <mailto:dnsext-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/dnsext>
List-Post: <mailto:dnsext@ietf.org>
List-Help: <mailto:dnsext-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsext>, <mailto:dnsext-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 25 Jan 2011 17:59:05 -0000

Paul,

See: draft-wijngaards-dnsop-trust-history-02

Abstract:
When DNS validators have trusted keys, but have been offline for a
longer period, key rollover will fail and they are stuck with stale
trust anchors.  History service allows validators to query for older
DNSKEY RRsets and pick up the rollover trail where they left off.

/S
----------------------------------------------------------------------
Stephan Lagerholm
Senior DNS Architect, M.Sc. ,CISSP
Secure64 Software Corporation, www.secure64.com
Cell: 469-834-3940

-----Original Message-----
From: dnsext-bounces@ietf.org [mailto:dnsext-bounces@ietf.org] On Behalf
Of Paul Wouters
Sent: Tuesday, January 25, 2011 11:53 AM
To: dnsext List
Subject: [dnsext] historal root keys for upgrade path?


A very large router vendor is about to make it mandatory that new
devices
they produce use dnssec by default. One issue that comes up with that
is what happens if these devices were off long enough for a rollover to
have happened and the RFC5011 bit/key has been retired.

Are there plans to create a zone with all old root keys, that all sign
the
DNSKEY RRset (eg rootkeys.root-servers.net) so that having ANY one old
root
key could lead you to get a signed version of the latest root key? This
way
you could disable DNSSEC to resolve rootkeys.root-servers.net, use your
current key to confirm the latest key, configure it, and drop the cache,
and you're golden.

Is something like this even possible? I'm not sure what happens to the
root private keys once they are retired...

Paul
_______________________________________________
dnsext mailing list
dnsext@ietf.org
https://www.ietf.org/mailman/listinfo/dnsext

v2.23.0 | Report a Bug | By Email