Re: Signature at parent (draft-ietf-dnsop-parent-sig-00.txt)

[Peter Koch <[e-mail]>]

> The problems with it are:
> 
> 1. Inflexibility: [...]
> 2. Cost: [...]
> 3. Liability:
>     He, who signs, must make sure that he knows he is signing, and
>     must accept some responsibility for it (otherwise the signature
>     is worthless). I think a TLD should accept the responsibility for
>     a proper delegation of a domain, but I don't think the TLD will
>     accept the responsibility for local stuff like IPSEC-KEYS under
>     those already delegated domains.

While I agree with (1) and (2), this statement sounds dangerous. SIG RRs
have a purpose defined and restricted by the "protocol" octet in the
corresponding KEY RR. SIGnatures for DNSSEC purposes provide for data
origin authentication. They do not say anything about applicability or
correctness of the signed data. So, a child's non-zone KEY RR SIGned by
the DNSSEC key of the parent zone is not 'certified' w.r.t. the protocol
it is made for. The normal resolution/verification process would only
accept the child's SIG for the KEY RR, wouldn't it?

-Peter



to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.