Re: [dnsext] historal root keys for upgrade path?

[Paul Wouters <[e-mail]>]

On Tue, 25 Jan 2011, Paul Hoffman wrote:

>> The anser seems to be "yes". It also means that some devices will fail
>> due to
>> firewall rules if this updating happens outside of the DNS scope.
>
> I don't understand this. I proposed that the updating procedure use fixed IP 
> addresses; are you saying that there are firewalls that prevent such 
> communication unless there was a DNS lookup first?

I dount many switches/routers deployed at $customer can just access a random
$vendor IP, yes.

>>> Bootstrapping is hard, but once you have done it, you can reuse the
>>> trust logic you used to do it again.
>> 
>> Not neccessarilly. Bootstreap happens on a desk at the sysadmin office, not
>> neccessarilly on the switch in the production environment....
>
> There is no reason why it can't happen at the switch itself, assuming that 
> you have not turned off the "trust the vendor to bootstrap DNSSEC" option in 
> the switch's config.

But dong tftp,http or even ssh is a much different ACL then "doing more DNS
through the $company assigned forwarder".

Paul