Re: [dnsext] historal root keys for upgrade path?

[Joe Abley <[e-mail]>]

On 2011-01-31, at 14:31, Nicholas Weaver wrote:

> If we have either an algorithm or KSK key compromise, we have a far bigger problem and going to a more human-centric route is probably doable.

The problem space we're considering is that of embedded devices (think 5,000,000 deployed linksys home gateways) for which a human-centric path is effectively not an option. No?

> ESPECIALLY if a failure for the TALINK-like mechanism (which fails for compromise-cases) is 'do leap of faith for the root for NON-secure records', so even then the name lookups etc will still work, only cryptographic trust mechanisms built on top of DNSSEC would fail.

The problem with the TALINK and similar trust-chaining proposals is that in the cases where you really need them, they can't work.

I don't think the scheme I just posted (and have described here before) is particularly elegant, but it has the benefit that it's immediately deployable and doesn't introduce any trust points into the system that aren't already there.


Joe