[DNSOP] new version: trust-history-02 draft

["W.C.A. Wijngaards" <[e-mail]>]

Hi,

http://tools.ietf.org/html/draft-wijngaards-dnsop-trust-history-02

Is available for review and comment.  This represents my take on how
to perform trust-anchor management for a validator without having
a system update mechanism (which works with unsafe DNS).

I have incorporated substantial comments and feedback.

o From Ted Lemon, Fixed the 'poison one upstream server'-attack.
o From Bert Hubert, Fixed the 'history in reverse'-attack.
o From Ed Lewis, Fixed so keys do not 'last forever'.
o From Mark Andrews, considerations for 5011-revocation.
o From Steve Crocker, Easy to test.
o From Bill Manning, can work on its own.
o From Wolfgang Nagele, zone owner advertising and 30days tweakable.
o From Olaf Kolkman, made the text easier to understand.
And more, sorry if I forgot here.

There is exactly one open issue:
o Publication of expired RRSIGs.
[ various people, Ed Lewis, Olaf Kolkman ]
This specification puts expired RRSIGs into the DNS and expects them
to be delivered.  What about 'smart' boxes that remove expired
signatures?  I think that boxes are not allowed to remove 'expired'
signatures.  This is why we have the CD flag.  This is good to put
into dnssec-bis-updates?
One solution may be a 'HISTORICAL_RRSIG' new type.  Which needs a
new type allocation, where perhaps RRSIG serves perfectly fine.
Also RRSIG is sent with a DNSKEY answer.  HISTORICAL_RRSIG
causes extra queries to get it.

Best regards,
   Wouter