IETF Logo Mail Archive

Re: [DNSOP] WGLC draft-ietf-dnsop-dnssec-key-timing-03.txt until 2012-09-14

Tony Finch <dot@dotat.at> Mon, 10 September 2012 16:17 UTC

Return-Path: <fanf2@hermes.cam.ac.uk>
X-Original-To: dnsop@ietfa.amsl.com
Delivered-To: dnsop@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4914221F8446 for <dnsop@ietfa.amsl.com>; Mon, 10 Sep 2012 09:17:38 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -5.696
X-Spam-Level:
X-Spam-Status: No, score=-5.696 tagged_above=-999 required=5 tests=[AWL=0.303, BAYES_00=-2.599, J_CHICKENPOX_35=0.6, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4E5SqCaSkHYm for <dnsop@ietfa.amsl.com>; Mon, 10 Sep 2012 09:17:37 -0700 (PDT)
Received: from ppsw-41.csi.cam.ac.uk (ppsw-41.csi.cam.ac.uk [131.111.8.141]) by ietfa.amsl.com (Postfix) with ESMTP id 1642921F843E for <dnsop@ietf.org>; Mon, 10 Sep 2012 09:17:36 -0700 (PDT)
X-Cam-AntiVirus: no malware found
X-Cam-SpamDetails: not scanned
X-Cam-ScannerInfo: http://www.cam.ac.uk/cs/email/scanner/
Received: from hermes-1.csi.cam.ac.uk ([131.111.8.51]:51394) by ppsw-41.csi.cam.ac.uk (smtp.hermes.cam.ac.uk [131.111.8.156]:25) with esmtpa (EXTERNAL:fanf2) id 1TB6g2-0002YT-RF (Exim 4.72) (return-path <fanf2@hermes.cam.ac.uk>); Mon, 10 Sep 2012 17:17:34 +0100
Received: from fanf2 by hermes-1.csi.cam.ac.uk (hermes.cam.ac.uk) with local id 1TB6g2-0000zN-Di (Exim 4.72) (return-path <fanf2@hermes.cam.ac.uk>); Mon, 10 Sep 2012 17:17:34 +0100
Date: Mon, 10 Sep 2012 17:17:34 +0100
From: Tony Finch <dot@dotat.at>
X-X-Sender: fanf2@hermes-1.csi.cam.ac.uk
To: Olafur Gudmundsson <ogud@ogud.com>
In-Reply-To: <504E050E.7070002@ogud.com>
Message-ID: <alpine.LSU.2.00.1209101623160.9973@hermes-1.csi.cam.ac.uk>
References: <20120823214924.GL30725@x28.adm.denic.de> <504E050E.7070002@ogud.com>
User-Agent: Alpine 2.00 (LSU 1167 2008-08-23)
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset="US-ASCII"
Sender: Tony Finch <fanf2@hermes.cam.ac.uk>
Cc: Peter Koch <pk@DENIC.DE>, IETF DNSOP WG <dnsop@ietf.org>
Subject: Re: [DNSOP] WGLC draft-ietf-dnsop-dnssec-key-timing-03.txt until 2012-09-14
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/dnsop>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 10 Sep 2012 16:17:38 -0000

Olafur Gudmundsson <ogud@ogud.com> wrote:
>
> Section 2.2 and 2.3.
>
> The document says that Pre-Publication is not applicable to KSK
> rollover, this is wrong as new KSK can be added to the childs DNSKEY
> RRset without signing the DNSKEY RRset, there is nothing in the
> protocol specifcation that prevents this.

There is an important difference, though. A pre-published ZSK is
immediately useful for signing without any further steps required (after
waiting for cache expiry). If you pre-publish a KSK you don't get usefully
closer to adding the new link in the chain of trust: you still have to go
through a complete iteration of one of the KSK rollover procedures
described in the draft, except instead of adding the new KSK+RRSIG you
only need to add the new RRSIG.

So I'm not sure what is the value of mentioning this possibility.

Tony.
-- 
f.anthony.n.finch  <dot@dotat.at>  http://dotat.at/
Forties, Cromarty: East, veering southeast, 4 or 5, occasionally 6 at first.
Rough, becoming slight or moderate. Showers, rain at first. Moderate or good,
occasionally poor at first.

v2.23.0 | Report a Bug | By Email