Re: OFFTOPIC: DNSSEC groupthink versus improving DNS

[Havard Eidnes <[e-mail]>]

>   * Are there any open protocol issues which make such a
>     "single checkbox" deployment of DNSSEC impossible?

The need to communicate off-line or at least out-of-protocol with
the parent zone administrator when you need to change/roll-over your
KSKs -- this is probably what you meant by "automatic DS generation
in the parent" in your next item.  Although this might be seen as
similar to making changes to the NS RRset, the initiative is
triggered by a timer and not by administrator action, which is a
considerable change from previous operational practice.

There's also the issue of trust anchor maintenance, but that's being
worked on, as I understand it.

When reading some of the DNSSEC RFCs, I've sometimes come away with the
understanding that the authors think that "zone administrators needs to
sign the zone on an off-line machine to maintain a sufficiently high
level of security".  If I've understood correctly, that's completely at
odds with the goal of having a fully automated feature with a checkbox
for "maintain (generate and periodically roll) ZSKs and KSKs and sign
and re-sign all my zones automatically".  My guess is that only TLD and
root zone maintainers would care enough about their zones and keys to
bear the level of pain involved in implementing complete off-line
signing ("zone transfer via sneakernet").  For a simple leaf zone master
name server administrator, is there a good reason he needs to care more
about his DNS private keys than about the protection and host security
on the master name server (which might be "hidden", i.e. not in the NS
set)?  (OK, that probably wasn't a protocol issue...)

Then there's the aspect of having the root signed, which is really
needed in order to alleviate the pain of maintaining the trust
anchors, a pain which is to be felt on all the recursive name servers
who want to get the benefits of DNSSEC.  Even if it appears to be a
non-protocol issue does not make it any less important in the view of
deployment.

Best regards,

- Håvard

--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>