Re: [DNSOP] zone signing with or without parental buy-in

bmanning@vacation.karoshi.com Sun, 07 March 2010 17:10 UTC

Return-Path: <bmanning@karoshi.com>
X-Original-To: dnsop@core3.amsl.com
Delivered-To: dnsop@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 0379D3A8FD7 for <dnsop@core3.amsl.com>; Sun, 7 Mar 2010 09:10:17 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -5.987
X-Spam-Level:
X-Spam-Status: No, score=-5.987 tagged_above=-999 required=5 tests=[AWL=0.482, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, SARE_RMML_Stock10=0.13]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jZfKMb-XG4aQ for <dnsop@core3.amsl.com>; Sun, 7 Mar 2010 09:10:14 -0800 (PST)
Received: from vacation.karoshi.com (vacation.karoshi.com [198.32.6.68]) by core3.amsl.com (Postfix) with ESMTP id C71373A8EEE for <dnsop@ietf.org>; Sun, 7 Mar 2010 09:10:14 -0800 (PST)
Received: from karoshi.com (localhost.localdomain [127.0.0.1]) by vacation.karoshi.com (8.12.8/8.12.8) with ESMTP id o27HAGrU010626; Sun, 7 Mar 2010 17:10:17 GMT
Received: (from bmanning@localhost) by karoshi.com (8.12.8/8.12.8/Submit) id o27HAFnN010625; Sun, 7 Mar 2010 17:10:15 GMT
Date: Sun, 07 Mar 2010 17:10:15 +0000
From: bmanning@vacation.karoshi.com
To: Jim Reid <jim@rfc1035.com>
Message-ID: <20100307171015.GA10580@vacation.karoshi.com.>
References: <2AA0F45200E147D1ADC86A4B373C3D46@localhost> <A76BB63E-F13B-4D90-BABB-89EB06C8E5F0@rfc1035.com> <20100307123712.GA9325@vacation.karoshi.com.> <DE8A495E-9C07-4EBB-A0F7-F2BCE5224264@rfc1035.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <DE8A495E-9C07-4EBB-A0F7-F2BCE5224264@rfc1035.com>
User-Agent: Mutt/1.4.1i
Cc: bmanning@vacation.karoshi.com, IETF DNSOP WG <dnsop@ietf.org>
Subject: Re: [DNSOP] zone signing with or without parental buy-in
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/dnsop>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 07 Mar 2010 17:10:17 -0000

On Sun, Mar 07, 2010 at 01:43:36PM +0000, Jim Reid wrote:
> On 7 Mar 2010, at 12:37, bmanning@vacation.karoshi.com wrote:
> 
> >ah come on Jim... folsk should sign their zones as soon
> >as they see fit, regardless of parental buy in.
> 
> Bill, IMO there's not much point in signing root-servers.net until its  
> parents are signed. [And as I explained earlier, signing that zone is  
> highly unlikely to make any difference to the threat of spoofed  
> responses to priming queries.] While folk should sign zones as they  
> see fit, lack of parental buy-in is a major reason why they don't sign  
> their zones. The horrors of alternate Trust Anchors should make  
> everyyone think very long and hard about when to deploy DNSSEC.

	and you think this is the primary reason to sign/not sign?
	i suspect that the real reason to sign early/often is actuall
	enumerated below.
 
> This is maybe just about tolerable for a handful of TLDs. However I  
> hope all this will melt away once we reached the promised land of a  
> signed root this summer.
	
	signed root nirvana anint going to happen.

> That said, I'd encourage people to put zone signing into pre- 
> production so they can figure out how to update procedures and  
> documentation, train ops/support staff and also get experience with  
> signing tools, key rollovers and so forth. They'll then be ready to  
> flick the switch come the glorious day when their parent(s) are  
> signing delegations.

	bingo.  thats the reason to sign now, irrespective
	of some laggard parent.

--bill