Re: [dnsext] historal root keys for upgrade path?

[Joe Abley <[e-mail]>]

On 2011-01-30, at 14:45, Tony Finch wrote:

> On 28 Jan 2011, at 06:06, David Conrad <[e-mail]> wrote:
>> 
> 
>> I don't think that's a risk. If a key is rolled because of a known compromise, it simply means you can't safely chain from the old-but-installed-key to the current-but-not-yet-installed key.  Presumably, when a key is known to be compromised, the chain from old to current keys would be broken such that automated systems would require human intervention.
> 
> If you implement RFC5011 you can maintain a chain of trust in the face of N-1 key compromises where N is the number of keys in the trust anchor.

I thought this whole thread was about how to handle an initial bootstrap, e.g. in a new device, in a device that has been off-line for longer than the 5011 key introduction period, or in the event that an emergency key roll results in a change in KSK without 5011 timing or publishing semantics.


Joe