Re: [dnsext] Historical root keys: The Large Router Vendor Speaks

[Florian Weimer <[e-mail]>]

* John Bashinski:

> I am, however, the person who's writing the internal standards in
> question for the "large router vendor", and I guess I've just authorized
> myself to disclose what the "large router vendor" is thinking about
> doing, so that maybe some of the constraints are a little more clear.

Would it help you if there weren't any vanity key rollovers at all?

Then the remaining cases are, as far as I can see:

  (i) key is lost

  (ii) key is compromised

  (iii) cryptographic algorithms are compromised

  (iv) control of the root zone changes

In cases (i), (iv), you cannot expect that the new key material will
be signed by the old.

In case (ii), you cannot rely on the signature from the old key
material.

In case (iii), you'll likely need a firmware update to implement new
algorithms, and you can ship new key material with that.

What am I missing?

-- 
Florian Weimer                <[e-mail]>
BFK edv-consulting GmbH       http://www.bfk.de/
Kriegsstraße 100              tel: [phone]
D-76133 Karlsruhe             fax: [phone]