Re: Signature at parent (draft-ietf-dnsop-parent-sig-00.txt)

[Olaf Kolkman <[e-mail]>]

Edward Lewis <[e-mail]> responding to Miek:

 * >We are not sure how or why you come to this conclusion from section
 * >4. The idea was, and still is, to have a short  transition period
 * >where both the old and new key are active.
 * 
 * One of the smokdering debates is why there is the need for roll over.  On
 * the one hand, old SIGs might still be fine if the old key is around.  On
 * the other hand, isn't the fact that a new key is available mean you should
 * forget the old data?
 * 
 * Now, the desire to use the old key to sign the new key set is the first
 * requirement I have heard that justifies the continued use of the old key
 * once the new key is present.
 * 

FYI:

The scheme I posted on Friday drops the requirement to have the old
KEY around. Actually it requires the old key NOT to be around. (If you
would keep the key in the keyset, and the parent would not keep state,
you might be able to trigger keyrollovers by spoofed notifies.)

"Isn't the fact that a new key is available mean you should forget the
old data?" seems to be an important question to answer...


--Olaf


to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.