Re: Signature at parent (draft-ietf-dnsop-parent-sig-00.txt)

[Edward Lewis <[e-mail]>]

At 9:49 AM -0400 4/5/01, Miek Gieben wrote:
>2.2. SIG expiration considerations
>   The expiration lifetime of the parental SIG over the
>child's zone KEY MUST be kept as short as possible. A good
>value is one day. If there is a child KEY compromise, the
>SIGs for that zone are only valid for as long as the
>parental SIG is valid. The selfsigned zone KEY stored in the
>child's zone can have a much longer expiration lifetime.
>The SIG at the child does not serve any purpose, a lifetime
>measured in years is not uncommon.

"MUST be kept as short as possible" is poorly worded.  The use of the
subjective "as possible" makes the use of MUST incorrect, a SHOULD would be
more appropriate.

I don't know if a hard requirement can be placed here.  Ultimately, it's up
to the registry to decide how often they will resign the keys.
Technically, it is good to limit the lifetime of a SIG, but this incurs a
staffing cost.

(Ya' know, this discussion borders on dnsop quite frequently.)

>
>-----------
>I don't (yet) know if it matters if a child has a shorter
>lifetime on the sig than the parent.

The meanings of the SIG by the parent and the SIG by the child are almost
unrelated.  The parent says "this key is good" and the child says "I have
the private key for this."  Because of this, I can't justify tying the two
SIG durations in a specification.


>We are not sure how or why you come to this conclusion from section
>4. The idea was, and still is, to have a short  transition period
>where both the old and new key are active.

One of the smokdering debates is why there is the need for roll over.  On
the one hand, old SIGs might still be fine if the old key is around.  On
the other hand, isn't the fact that a new key is available mean you should
forget the old data?

Now, the desire to use the old key to sign the new key set is the first
requirement I have heard that justifies the continued use of the old key
once the new key is present.


-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                                NAI Labs
Phone: [phone]                      Email: [e-mail]

Dilbert is an optimist.

Opinions expressed are property of my evil twin, not my employer.




to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.