[dnsop] draft-ietf-dnsop-key-rollover-requirements-01.txt

Miek Gieben <miekg@atoom.net> Thu, 07 October 2004 12:56 UTC

Date: Thu, 07 Oct 2004 12:14:59 +0200
From: Miek Gieben <miekg@atoom.net>
To: dnsop <dnsop@lists.uoregon.edu>
Subject: [dnsop] draft-ietf-dnsop-key-rollover-requirements-01.txt
Message-ID: <20041007101459.GA773@atoom.net>
Mail-Followup-To: dnsop <dnsop@lists.uoregon.edu>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
User-Agent: Vim/Mutt/Linux
Sender: owner-dnsop@lists.uoregon.edu
Precedence: bulk
Reply-To: Miek Gieben <miekg@atoom.net>

Hello,

I've read the this draft again, and I still have trouble seeing what it 
is trying to say.

Olaf and I have incorperated some text from this draft into our operational
practices document (with consent from Gilles). This has lead to the following
paragraph being included:

3.3.4  Automated Key Rollovers

   As keys must be renewed periodically, there are some motivation to
   automate the rollover process.

   o  ZSK rollovers are easy to automate as only the local zone is
      involved.
   o  A KSK rollover needs interaction between the parent and child.
      Data exchange is needed to provide the new keys to the parent,
      consequently, this data must be authenticated and integrity must
      be guaranted in order to avoid attacks on the rollover.
   o  All time and TTL considerations presented in Section 3.3 apply to
      an automated rollover.  


With this text being added here (and credits being given ofcourse), what should
happen with the draft-ietf-dnsop-key-rollover-requirements-01.txt?

grtz,
--Miek
.
dnsop resources:_____________________________________________________
web user interface: http://darkwing.uoregon.edu/~llynch/dnsop.html
mhonarc archive: http://darkwing.uoregon.edu/~llynch/dnsop/index.html

[dnsop] draft-ietf-dnsop-key-rollover-requirement… Miek Gieben