Re: [dnsext] Historical root keys: The Large Router Vendor Speaks

[Phillip Hallam-Baker <[e-mail]>]

On Thu, Jan 27, 2011 at 3:21 PM, John Bashinski <[e-mail]> wrote:

>
> Using the current public X.509 PKI is NOT under consideration.
>
> Just to be clear, it was never proposed, except as a straw man by Paul
Wouters.

What I suggested was that we look at the possibilities of using X.509
standards and infrastructure that has been developed to meet similar
considerations in that space. I think it is abundantly clear that we do not
want the criteria for signing the root KSK to be  inclusion in some browser
root anchor list.

X.509 is designed to deal with persistent keys, DNS is not designed to
persist data.


I think that we should detach this problem from DNSSEC because we are going
to face the same problem for device keys. We have over the years created
quite a few consortiums that sign various CA certs for device keys and we
are in the process of creating more.

Ultimately these devices are going to have to tie into enterprise networks
and recognize the root of trust for the enterprise regardless of whether
their function requires them to also process DNSSEC or not.

So I would look to develop a scheme that addresses the problem of managing
the enterprise trust root first and then consider the IANA root key as being
a special case that would reuse the same code and management principles.


-- 
Website: http://hallambaker.com/