IETF Logo Mail Archive

Re: [DNSOP] how to delete obsolete DS for obsolete DNSKEY using CDS/CDNSKEY

Joe Abley <jabley@hopcount.ca> Fri, 07 February 2014 19:12 UTC

Return-Path: <jabley@hopcount.ca>
X-Original-To: dnsop@ietfa.amsl.com
Delivered-To: dnsop@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7A6371ACCF8 for <dnsop@ietfa.amsl.com>; Fri, 7 Feb 2014 11:12:04 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.001
X-Spam-Level:
X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CEvRu35JVBHw for <dnsop@ietfa.amsl.com>; Fri, 7 Feb 2014 11:12:02 -0800 (PST)
Received: from mail-ie0-x22f.google.com (mail-ie0-x22f.google.com [IPv6:2607:f8b0:4001:c03::22f]) by ietfa.amsl.com (Postfix) with ESMTP id D321C1ACCEF for <dnsop@ietf.org>; Fri, 7 Feb 2014 11:12:02 -0800 (PST)
Received: by mail-ie0-f175.google.com with SMTP id ar20so1836647iec.6 for <dnsop@ietf.org>; Fri, 07 Feb 2014 11:12:02 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hopcount.ca; s=google; h=content-type:mime-version:subject:from:in-reply-to:date:cc :message-id:references:to; bh=A65gtCINO1b9jw6wdzZh4HCKqExy0csUpfIciBVpqMg=; b=IA8Ag4n+LzlNHRBJbBLXCKzinM5+qYf20msT1qM03/huoL8nX8uBEvk3G14JII+Cdw NCUom7w8PBrE9c6z5aoHRRndCPDi6/Fme4+rOaEe7nVYVbMt6inNfWQQosCTIaYxJT/2 7OutzmYZ9+VqJ2Lzs6O7/fFo8Ixa+zVGYNxMQ=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:content-type:mime-version:subject:from :in-reply-to:date:cc:message-id:references:to; bh=A65gtCINO1b9jw6wdzZh4HCKqExy0csUpfIciBVpqMg=; b=CsNW3z7sstputuxQ5xJZ3brRuzF5A9g3AdVtkkRq5fggjzojTy/mtnOG/vik/Ch5hD dpiQvgyfeaNIueAiUx8kU8w6ZcDMHxZ0nDcCjp++aV8nU2IjcfVjmCBWdBS5X5u3ABp+ h67He43EonrTeKkqxXw4Pv3gmzY7u66jj9oPTpSC2IHNUjuiAkXI9yJtFHD/6l+CAj7V Cs1gTzcwaUAVsDDoQmNkeB/RENUDVVkWF7ak6GcREbztwI5RFlgZoBY13uRDH5ejgIu8 FhPOWXXXVDxkCQmLI8PKrVz28Jt4TJMrROSSFL0bndt9A3TV2rgqhPQtVIYslMQq6vNR srUg==
X-Gm-Message-State: ALoCoQlAgBwZFrFLg7kAY+Xrnvyl5APcZBuBGGjRAPVS2PZU9iXlHizvPHmuoKsxU5CCwxv1rvnJ
X-Received: by 10.42.53.10 with SMTP id l10mr5189346icg.33.1391800322670; Fri, 07 Feb 2014 11:12:02 -0800 (PST)
Received: from [199.212.90.58] (24-52-234-221.cable.teksavvy.com. [24.52.234.221]) by mx.google.com with ESMTPSA id l7sm12499555igx.2.2014.02.07.11.12.00 for <multiple recipients> (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Fri, 07 Feb 2014 11:12:01 -0800 (PST)
Content-Type: multipart/signed; boundary="Apple-Mail=_2B294060-FF31-4390-8760-DDF4497B9D81"; protocol="application/pgp-signature"; micalg="pgp-sha1"
Mime-Version: 1.0 (Mac OS X Mail 7.1 \(1827\))
From: Joe Abley <jabley@hopcount.ca>
In-Reply-To: <52F52386.4070305@dougbarton.us>
Date: Fri, 07 Feb 2014 14:12:00 -0500
Message-Id: <0D3FD7ED-0A92-4B8E-9619-2B7D84013DD6@hopcount.ca>
References: <CAJE_bqe95pn8rHvK3UffPDn+_rGYiq2G5sfdgqisH4JG7gFjBA@mail.gmail.com> <CAHw9_i+Jt4Ok+CddheGT_nA=e4srgbUSQy98GeQ9qGn_Cncjag@mail.gmail.com> <52F52215.9090709@dougbarton.us> <CAHw9_i+Aanz5NZVO5Q_x=1zyFzHZSmeU6yoLx3cDkwD2sC-XMA@mail.gmail.com> <52F52386.4070305@dougbarton.us>
To: Doug Barton <dougb@dougbarton.us>
X-Mailer: Apple Mail (2.1827)
Cc: dnsop <dnsop@ietf.org>
Subject: Re: [DNSOP] how to delete obsolete DS for obsolete DNSKEY using CDS/CDNSKEY
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/dnsop/>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 07 Feb 2014 19:12:04 -0000

On 2014-02-07, at 13:18, Doug Barton <dougb@dougbarton.us> wrote:

> On 02/07/2014 10:14 AM, Warren Kumari wrote:
> 
>> We are not allowing zones to go from unsigned to signed:
> 
> Right, and because it says not to do it in the RFC no one is going to do it? :)

I don't see how it would work. The parental agent has no automated way to trust the C* RRSets published in a zone with no secure delegation from its parent.


Joe

v2.23.0 | Report a Bug | By Email