Re: [dnsext] historal root keys for upgrade path?

["W.C.A. Wijngaards" <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi Joe,

On 01/31/2011 01:14 PM, Joe Abley wrote:
> RFC 5011 is a mechanism for scheduled key rollovers. There is always
> the possibility that emergency key rollovers will happen, and that
> 5011 semantics (in particular the 30-day dual-publish window) might
> not be followed.

The approaches under discussion that I made rely on a 30-day
dual-publish window, the trust-history draft and the unbound-anchor
tool.  Because the approaches extend the 5011 mechanism with downtime
compensation.  You can see from the 5011 state why it is failing, and
30-days downtime caused it.  Increased speed for the bootstrap mechanism
would make that bootstrap mechanism less safe (because it can be used to
circumvent the 30-day timer in 5011), hence I chose to wait until 5011
is known to fail (30-days passed) so that this 'add-on' to 5011 would
not lower security.  Thus a fast rollover would break those deployments:
both 5011 and the bootstrap mechanism will fail, and the failure mode is
that the key is unchanged.  This is a feature, ... if you want software
deployed that does something else, then, it is good to have this
discussion :-)

Best regards,
   Wouter
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAk1GtKUACgkQkDLqNwOhpPjctQCfTAqOmPcmtXVmNkShmpzZ0Xao
3QUAnjCWf2NM751Q3GhsxAbRLWY/Yh5s
=OlbS
-----END PGP SIGNATURE-----