[DNSOP] I-D Action: draft-ietf-dnsop-maintain-ds-06.txt

internet-drafts@ietf.org Tue, 10 January 2017 23:59 UTC

Return-Path: <internet-drafts@ietf.org>
X-Original-To: dnsop@ietf.org
Delivered-To: dnsop@ietfa.amsl.com
Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 51282129424; Tue, 10 Jan 2017 15:59:38 -0800 (PST)
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
From: internet-drafts@ietf.org
To: i-d-announce@ietf.org
X-Test-IDTracker: no
X-IETF-IDTracker: 6.40.3
Auto-Submitted: auto-generated
Precedence: bulk
Message-ID: <148409277832.22242.18273110011780766407.idtracker@ietfa.amsl.com>
Date: Tue, 10 Jan 2017 15:59:38 -0800
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/wdEkysOctagnaFOadny-_x3NAlE>
Cc: dnsop@ietf.org
Subject: [DNSOP] I-D Action: draft-ietf-dnsop-maintain-ds-06.txt
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.17
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop/>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 10 Jan 2017 23:59:38 -0000

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Domain Name System Operations of the IETF.

        Title           : Managing DS records from parent via CDS/CDNSKEY
        Authors         : Olafur Gudmundsson
                          Paul Wouters
	Filename        : draft-ietf-dnsop-maintain-ds-06.txt
	Pages           : 10
	Date            : 2017-01-10

Abstract:
   RFC7344 specifies how DNS trust can be maintained across key
   rollovers in-band between parent and child.  This document elevates
   RFC7344 from informational to standards track and adds a standard
   track method for initial trust setup and removal of secure entry
   point.

   Changing a domain's DNSSEC status can be a complicated matter
   involving multiple unrelated parties.  Some of these parties, such as
   the DNS operator, might not even be known by all the organizations
   involved.  The inability to disable DNSSEC via in-band signaling is
   seen as a problem or liability that prevents some DNSSEC adoption at
   large scale.  This document adds a method for in-band signaling of
   these DNSSEC status changes.

   This document describes reasonable policies to ease deployment of the
   initial acceptance of new secure entry points (DS records)

   It is preferable that operators collaborate on the transfer or move
   of a domain.  The best method is to perform a Key Signing Key ("KSK")
   plus Zone Signing Key ("ZSK") rollover.  If that is not possible, the
   method using an unsigned intermediate state described in this
   document can be used to move the domain between two parties.  This
   leaves the domain temporarily unsigned and vulnerable to DNS
   spoofing, but that is preferred over the alternative of validation
   failures due to a mismatched DS and DNSKEY record.


The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-dnsop-maintain-ds/

There's also a htmlized version available at:
https://tools.ietf.org/html/draft-ietf-dnsop-maintain-ds-06

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-dnsop-maintain-ds-06


Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/