RE: [dnsop] Question on key rollover requirement

["Scott Hollenbeck" <[e-mail]>]

> -----Original Message-----
> From: Gilles Guette [mailto:[e-mail]] 
> Sent: Tuesday, September 14, 2004 10:32 AM
> To: dnsop
> Subject: [dnsop] Question on key rollover requirement
> 
> 
>   Hello,
> 
>   In the draft draft-ietf-dnsop-key-rollover-requirements-01.txt
>   we define requirements for automated key rollover between parent and
>   child zones.
> 
>   In section 4, we propose to use only DNSSEC mechanisms to secure
>   exchanged data between parent and child zones. Recent
>   comments from Olaf suggest to use another mechanism.
> 
>   I think the first question is:
>   Do the requirements include the choice of the mechanism used
>   to secure key exchanged between parent and child zones?

From my (admittedly biased*) perspective, yes, more than one method should
be available.  Some name server operators have to disallow certain update
and query features of the DNS protocol because the additional load on the
servers can have an adverse impact on "normal" query-response performance.
Exchanging dnssec data in-band is likely to fall into the same category of
operations.  I thus believe there are benefits to having other methods
available for parent-child communications.

>   If the answer is yes, there are several choices:
> 
>   DNSSEC only: motivation to use only DNSSEC mechanism is to keep
>   the automatic key rollover process independant from other protocol.
> 
>   Using IPsec to secure communications.
>   Using EPP.
>   ...
> 
>   We think that comments and discussions about this point are 
> needed to
>   enlightened pros and cons of each choice.

EPP is a definite possibility for those zone administrators who happen to be
using it for other related data provisioning services.  It won't be the
right answer for everyone, but I believe it makes sense to use this channel
if the infrastructure to support it is already in place.

-Scott-
* I am the author of an EPP-based mechanism for parent-child data exchange.


.
dnsop resources:_____________________________________________________
web user interface: http://darkwing.uoregon.edu/~llynch/dnsop.html
mhonarc archive: http://darkwing.uoregon.edu/~llynch/dnsop/index.html