IETF Logo Mail Archive

Re: How do we get the whole world to upgrade to DNSSEC capable resolvers?

Matthijs Mekking <matthijs@NLnetLabs.nl> Sat, 26 July 2008 21:31 UTC

Return-Path: <owner-namedroppers@ops.ietf.org>
X-Original-To: ietfarch-dnsext-archive@core3.amsl.com
Delivered-To: ietfarch-dnsext-archive@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 979CD3A69A2; Sat, 26 Jul 2008 14:31:45 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.599
X-Spam-Level:
X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id f0mJpd5VgjiR; Sat, 26 Jul 2008 14:31:44 -0700 (PDT)
Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 75FED3A68A1; Sat, 26 Jul 2008 14:31:43 -0700 (PDT)
Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from <owner-namedroppers@ops.ietf.org>) id 1KMrEG-000H1d-29 for namedroppers-data@psg.com; Sat, 26 Jul 2008 21:23:04 +0000
Received: from [2001:7b8:206:1::1] (helo=open.nlnetlabs.nl) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from <matthijs@nlnetlabs.nl>) id 1KMrEC-000H0x-1j for namedroppers@ops.ietf.org; Sat, 26 Jul 2008 21:23:02 +0000
Received: from [172.16.10.232] (guestroom-nat.meeting.ietf.org [130.129.64.64]) (authenticated bits=0) by open.nlnetlabs.nl (8.14.2/8.14.2) with ESMTP id m6QLMs9u086933 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Sat, 26 Jul 2008 23:22:55 +0200 (CEST) (envelope-from matthijs@nlnetlabs.nl)
Message-ID: <488B95AC.8030509@nlnetlabs.nl>
Date: Sat, 26 Jul 2008 23:22:52 +0200
From: Matthijs Mekking <matthijs@NLnetLabs.nl>
User-Agent: Thunderbird 2.0.0.14 (X11/20080502)
MIME-Version: 1.0
To: Stephane Bortzmeyer <bortzmeyer@nic.fr>
CC: namedroppers@ops.ietf.org
Subject: Re: How do we get the whole world to upgrade to DNSSEC capable resolvers?
References: <8A91CF57-0CBD-4CF2-BF59-C7D59CB4B7B9@virtualized.org> <20080724060743.GA7420@outpost.ds9a.nl> <48886C4D.4020500@ca.afilias.info> <63C0FFE7-17E6-4ECE-9A12-0537FE2E3F4B@ca.afilias.info> <4888FED2.6060204@NLnetLabs.nl> <E7388E94-D031-4059-91F9-1596A254E21C@ca.afilias.info> <20080725193101.GB8193@outpost.ds9a.nl> <BEADC795-3C76-407A-A979-2B0AAACE0328@ca.afilias.info> <20080725221002.GK29775@commandprompt.com> <OFF4F9438A.D83AC9AB-ON80257491.007DB303-C1257491.007FA301@nominet.org.uk> <20080726144111.GA5204@laperouse.bortzmeyer.org>
In-Reply-To: <20080726144111.GA5204@laperouse.bortzmeyer.org>
X-Enigmail-Version: 0.95.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-Greylist: Sender succeeded SMTP AUTH authentication, not delayed by milter-greylist-3.0 (open.nlnetlabs.nl [213.154.224.1]); Sat, 26 Jul 2008 23:22:55 +0200 (CEST)
Sender: owner-namedroppers@ops.ietf.org
Precedence: bulk
List-ID: <namedroppers.ops.ietf.org>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Stephane Bortzmeyer wrote:
> On Sat, Jul 26, 2008 at 01:14:08AM +0200,
>  Roy Arends <roy@nominet.org.uk> wrote 
>  a message of 28 lines which said:
> 
>> When a validator has a trust anchor configured for root, it _expects_ 
>> signatures for root. 
> 
> Which means there is no way back? If we sign ".fr", and people start
> to configure the trust anchor for ".fr" in their validating resolvers,
> we can no longer revert to the original, non-signed, system, should
> problems occur?

If you use a mechanism like described in rfc5011, there is a way back.
Section 5 says:

"A trust point that has all of its trust anchors revoked is considered
 deleted and is treated as if the trust point was never configured."

So you have to revoke your KSKs and give resolvers some time to update
their trust anchors.

- - Matthijs




-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFIi5WsIXqNzxRs6egRAmidAJ42jQ5mnJIqztMYAsAE3hZcyiRYagCfR4W9
nK7o/eebFI1iySR+iNqAlUY=
=mjym
-----END PGP SIGNATURE-----

--
to unsubscribe send a message to namedroppers-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

v2.23.0 | Report a Bug | By Email