Re: [DNSOP] I-D Action:draft-ietf-dnsop-rfc4641bis-01.txt

[Florian Weimer <[e-mail]>]

* Edward Lewis:

> This comes from the observation that the contents of the database
> sourcing the zone (whether a commercial-like database or a vi'd file)
> are more critical than the private key.  (If) They are sufficiently
> protected and I'll just keep the private key behind the same
> fortifications.  So, what does an HSM add?

I think the general idea is that if you have to edit your zone because
it was tampered with, chances are that nobody will notice (or
everybody will attribute it to routine maintenance).  If your key is
compromised and you have to replace it out of schedule, you might have
got some explaining to do. 8-)

Of course, this isn't a strong argument in favor of HSMs.

-- 
Florian Weimer                <[e-mail]>
BFK edv-consulting GmbH       http://www.bfk.de/
Kriegsstraße 100              tel: [phone]
D-76133 Karlsruhe             fax: [phone]