Re: [dnsop] Comments on draft-ietf-dnsop-key-rollover-requirements

[Ben Laurie <[e-mail]>]

Olaf M. Kolkman wrote:
> I hope that other WG participants look at this draft as well.

As requested, I've just been through it. Comments below...

Generally: there's no mention of what keys will be used to authenticate 
key rollover. I would say that it should be a requirement that these are 
_not_ the same as any of the KSKs or ZSKs in use for signing the zone. 
There also should be, IMO, no way to automatically roll such keys, or 
you end up in an infinite regression.

I'm also a little surprised that it is proposed to invent yet another 
mechanism for exchanging and authenticating keys when several exist 
already, such as OpenPGP or X.509. Why not reuse one of these?

> 5.  Emergency Rollover

This section appears to be suggesting that emergency rollover can be 
automated. Whilst this is true if the above requirements are adopted, it 
needs to be clear that if the rollover authentication keys have been 
compromised, some other mechanism MUST be used.

Cheers,

Ben.

-- 
ApacheCon! 13-17 November! http://www.apachecon.com/

http://www.apache-ssl.org/ben.html       http://www.thebunker.net/

"There is no limit to what a man can do or how far he can go if he
doesn't mind who gets the credit." - Robert Woodruff
.
dnsop resources:_____________________________________________________
web user interface: http://darkwing.uoregon.edu/~llynch/dnsop.html
mhonarc archive: http://darkwing.uoregon.edu/~llynch/dnsop/index.html