Re: [DNSOP] DLVs and ITAR

[Edward Lewis <[e-mail]>]

At 14:45 -0400 9/14/09, David Blacka wrote:

>I think it works to simply say this:
>
>   * The ITAR should be checked for changes once per 24 hour period.
>
>Then:
>
>   * consumers (e.g., dlv.isc.org, me) will know to check at least 
>once per day;
>   * TLD operators would know to pre-publish the new DS at least 24 hours
>     before doing the KSK roll.

Plus an allowance for TTLs.

It's a bit more complicated I think, unless I missed a fine point in 
the message.

To nit pick: "TLD operators would know to pre-publish the new DS" is 
incorrect per se - the DS set for a zone is authoritative at the 
parent.

When I want to change a SEP, first I plan to have it in my DNSKEY set 
for a long enough period to satisfy at least RFC 5011 and the time it 
takes for all caches to time out all DNSKEY set versions prior to the 
new SEP-to-be.

Next I add the new SEP signature to the DNSKEY set and ask the parent 
to change the DS record in my DS RRSet.  Change means take out the 
old and put in the new (per algorithm/etc.).  I don't remove anything 
at this point.

I don't think the parent's TTL considerations matter because I am 
placing two SEP's in to play while waiting.  As soon as I see the new 
DS record appear in the zone (and the old DS gone), I start a timer 
based on my TTL for the DNSKEY set.  Once that timer expires I 
RFC5011-revoke the old SEP (and sign the whole key set with old and 
new SEP key).

According to RFC 5011 rules I then remove the old SEP and any 
signature at the appropriate time.

>As it is, I don't expect any TLD operator to have any idea of how 
>long they must pre-publish, nor any consumer to know how often to 
>poll IANA for any changes.

Polling is suboptimal when an event is anticipated but it is a good 
catch all to avoid missing an event notification.

-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis
NeuStar                    You can leave a voice message at [phone]

As with IPv6, the problem with the deployment of frictionless surfaces is
that they're not getting traction.