Re: [DNSOP] Updated KSK Sentinel document

On Tue, Feb 13, 2018 at 1:49 PM, Wessels, Duane <dwessels@verisign.com> wrote:
>
>> On Feb 13, 2018, at 9:10 AM, Bob Harold <rharolde@umich.edu> wrote:
>>
>> If an entry could be put in the root zone, that is signed only with the new key, then could users query that and always get a yes/no answer to whether they will be affected?
>
> This doesn't work because when the new key is published in the zone (and signed by the old key, as it must be),

Yup - this is the critical bit -- a number of us keep going down the
"Oooh! This is easy, we just publish Im-only-signed-with-2222. in the
root, and then people who cannot resolve that know that they don't
have 2222". And then killjoys like yourself point out that DNSSEC
doesn't actually work like that.... :-)

W

>then the new key becomes trusted by the validator.  Thus, there is still a valid chain-of-trust to those records for those with only the old TA.
>
> DW
>
> _______________________________________________
> DNSOP mailing list
> DNSOP@ietf.org
> https://www.ietf.org/mailman/listinfo/dnsop

-- 
I don't think the execution is relevant when it was obviously a bad
idea in the first place.
This is like putting rabid weasels in your pants, and later expressing
regret at having chosen those particular rabid weasels and that pair
of pants.
   ---maf