Re: [DNSOP] Emergency KSK Rollover for locally secure zones.

[Aanchal Malhotra <[e-mail]>]

On Thu, Aug 3, 2017 at 10:06 PM, Wessels, Duane <[e-mail]>
wrote:

>
> > On Aug 3, 2017, at 12:58 PM, Aanchal Malhotra <[e-mail]> wrote:
> >
> > However, I still don't see how it would help in case of trust anchor/KSK
> compromise.
>
> This is why I wrote "I don't know if you consider it a solution."
>
> Even so, I think it could be useful, depending on the nature and scale of
> the zone in question.  For example, if you had to perform an emergency KSK
> rollover you might do something like email a group of administrators with
> instructions to manually update their trust anchors.  RFC 8145 would help
> you know how many administrators followed through on that request.
>



* "If the network administrator has an out-of-band method of contacting
resolver administrators that have stored the public key as a trust anchor
(such as e-mail), the network administrator should send out appropriate
warnings and set up a trusted means of disseminating the new trust anchor.
Otherwise, the DNS administrator can do nothing except pre-publish the new
KSK with ample time to give resolver administrators enough time to learn
the new KSK."*
Sure you are right! But my question was for the "Otherwise" situation.

>
> DW
>
>