Re: Signature at parent (draft-ietf-dnsop-parent-sig-00.txt)

[[e-mail] (Ted Lindgreen)]

[Quoting Brian Wellington, on Apr  2, 22:47, in "Re: Signature at par ..."]

> Given the lack of a defined parent-child communication mechanism, this is
> a problem.  At the workshop, that mechanism was voice, if I recall.  It
> could also be something like NOTIFY, though, which would allow the child
> to take an action and fetch the signed key from the parent.

The issue here is scaling, which already in the workshop (with only
a handfull of children) turned out to be a problem. At CAIRN, this
problem also surfaces. Please give it some thought when a parent
must deal with hundreds of thousands (the average ccTLD) or even
millions (the larger ccTLD and .com for instance) of children.

Suppose the parent want to renew its KEY, and the children hold the
SIGs.  After the parent has notified (be it by voice, telephone,
e-mail, or NOTIFY) its children, these children need to react.  It
is clear, that some of them will not react for several reasons:
network problem, sysadm on holiday, server problem, workoverload,
etc. etc.
So, our poor TLD zoneadministrator must make a choice:
1. Wait for all of them (but he... perhaps the new SIG expires before..).
2. Wait for some percentage of its children to have reacted.
3. Just continue after a specified timeout.

Not only a difficult choice, also non of them is fair (3. perhaps
looks fair "they should have done their thing, if not, it's their
problem"; however, what if none/some of the NOTIFY's reached their
destination due to TLDs fault or a network failure?).
In our opinion, this is not going to work.

However, if we turn it around: the child notifies the parent that
it wants a new KEY:
For ONE key, there is now only ONE notify and only ONE parent-child
relation in play. If the parent does not react, there is ONE sysadm
to complain to ONE other sysadm. This scales.

Regards,
-- Ted.


to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.