Re: [DNSOP] HSMs was Re: I-D Action:draft-ietf-dnsop-rfc4641bis-01.txt

Edward Lewis <Ed.Lewis@neustar.biz> Tue, 21 April 2009 20:38 UTC

Return-Path: <Ed.Lewis@neustar.biz>
X-Original-To: dnsop@core3.amsl.com
Delivered-To: dnsop@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 602623A7065 for <dnsop@core3.amsl.com>; Tue, 21 Apr 2009 13:38:17 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.889
X-Spam-Level:
X-Spam-Status: No, score=-1.889 tagged_above=-999 required=5 tests=[AWL=0.710, BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5OD8q4f6q9oK for <dnsop@core3.amsl.com>; Tue, 21 Apr 2009 13:38:16 -0700 (PDT)
Received: from stora.ogud.com (stora.ogud.com [66.92.146.20]) by core3.amsl.com (Postfix) with ESMTP id BDDCE28C3A6 for <dnsop@ietf.org>; Tue, 21 Apr 2009 13:37:33 -0700 (PDT)
Received: from [10.31.200.142] (ns.md.ogud.com [10.20.30.6]) by stora.ogud.com (8.14.3/8.14.3) with ESMTP id n3LKR8B4037966; Tue, 21 Apr 2009 16:27:12 -0400 (EDT) (envelope-from Ed.Lewis@neustar.biz)
Mime-Version: 1.0
Message-Id: <a06240802c613da7c3026@[10.31.200.142]>
In-Reply-To: <20090421180927.GG64986@shinkuro.com>
References: <20090306141501.4BA2F3A6B4B@core3.amsl.com> <49EDA81E.2000600@ca.afilias.info> <a06240805c6138a622949@[10.31.200.142]> <82iqkykq10.fsf@mid.bfk.de> <a06240807c61393343ac7@[10.31.200.142]> <20090421153213.GA7564@nic.fr> <a06240808c61397d750db@[10.31.200.142]> <20090421160040.GD64986@shinkuro.com> <a06240800c613abf111de@[10.31.200.142]> <20090421180927.GG64986@shinkuro.com>
Date: Tue, 21 Apr 2009 16:25:55 -0400
To: Andrew Sullivan <ajs@shinkuro.com>
From: Edward Lewis <Ed.Lewis@neustar.biz>
Content-Type: text/plain; charset="us-ascii"; format="flowed"
X-Scanned-By: MIMEDefang 2.64 on 66.92.146.20
Cc: dnsop@ietf.org
Subject: Re: [DNSOP] HSMs was Re: I-D Action:draft-ietf-dnsop-rfc4641bis-01.txt
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/dnsop>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 21 Apr 2009 20:38:17 -0000

At 14:09 -0400 4/21/09, Andrew Sullivan wrote:

>Anyway, I completely agree that this is a cost-benefit analysis that
>different sites have to do based on their use cases.

I appreciate the value of having an HSM that complies with public 
certifications and would use one that tipped the cost-benefit 
analysis in it's favor.  Whether or not meeting a public 
certification is desirable is not (just) a technical design point, 
whether or not it is also a good idea.

I started this thread as a reaction to the comment that the subject's 
draft say "useful to recommend HSM" and I wasn't so sure I'd hum to 
that.

What I'm really looking for a convincing argument that I really 
should be using an HSM other than it would make me sleep better in 
meetings, I mean, at night.
-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis
NeuStar                    You can leave a voice message at +1-571-434-5468

Getting everything you want is easy if you don't want much.