Re: [dnsext] does making names the same NEED protocol changes at all?

[Phillip Hallam-Baker <[e-mail]>]

On Fri, Feb 25, 2011 at 12:46 PM, Andrew Sullivan <[e-mail]> wrote:

> On Fri, Feb 25, 2011 at 12:43:29PM -0500, Phillip Hallam-Baker wrote:
> > Requiring slaves to be signers is a major change to the security model.
>
> Depending on how you implement this, it might be.  But anyway, this is
> why we are doing a requirements analysis _before_ we start planning
> how to solve these problems, since it isn't obvious at least to me
> that what you describe above is a requirement in any case.


True, but what I was originally complaining about was the rush to put this
on the table in the first place and then I was reacting to the statements to
the effect that this is no big deal.

As a provider of DNS services I think that we have to have a very clear
requirement that any proposed solution not impact the deployments of DNSSEC
currently taking place. Requiring servers be capable of signing inline would
represent a major architectural change. It would have a major impact on the
cost of deployment.


At the moment I can put a DNS slave pretty much anywhere. If I need more
capacity I can simply rent it as required at commodity rates.

If every slave has to be a signer then I either have to engage in some very
expensive engineering effort or I have to locate every slave in a Tier 6
secure facility.

-- 
Website: http://hallambaker.com/