[DNSOP] I-D Action: draft-ietf-dnsop-maintain-ds-04.txt
internet-drafts@ietf.org Mon, 31 October 2016 15:35 UTC
Return-Path: <internet-drafts@ietf.org>
X-Original-To: dnsop@ietf.org
Delivered-To: dnsop@ietfa.amsl.com
Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 857DB129569; Mon, 31 Oct 2016 08:35:07 -0700 (PDT)
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
From: internet-drafts@ietf.org
To: i-d-announce@ietf.org
X-Test-IDTracker: no
X-IETF-IDTracker: 6.36.0
Auto-Submitted: auto-generated
Precedence: bulk
Message-ID: <147792810754.32434.7815626160706350019.idtracker@ietfa.amsl.com>
Date: Mon, 31 Oct 2016 08:35:07 -0700
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/xLRNGsrs0HWx18kyA8IzLcga5Io>
Cc: dnsop@ietf.org
Subject: [DNSOP] I-D Action: draft-ietf-dnsop-maintain-ds-04.txt
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.17
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop/>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 31 Oct 2016 15:35:07 -0000
A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Domain Name System Operations of the IETF. Title : Managing DS records from parent via CDS/CDNSKEY Authors : Olafur Gudmundsson Paul Wouters Filename : draft-ietf-dnsop-maintain-ds-04.txt Pages : 10 Date : 2016-10-31 Abstract: RFC7344 specifies how DNS trust can be maintained across key rollovers in-band between parent and child. This document elevates RFC7344 from informational to standards track and adds a standard track method for initial trust setup and removal of secure entry point. Changing a domain's DNSSEC status can be a complicated matter involving multiple unrelated parties. Some of these parties, such as the DNS operator, might not even be known by all the organizations involved. The inability to disable DNSSEC via in-band signaling is seen as a problem or liability that prevents some DNSSEC adoption at large scale. This document adds a method for in-band signaling of these DNSSEC status changes. This document describes reasonable policies to ease deployment of the initial acceptance of new secure entry points (DS records) It is preferable that operators collaborate on the transfer or move of a domain. The best method is to perform a Key Signing Key ("KSK") plus Zone Signing Key ("ZSK") rollover. If that is not possible, the method using an unsigned intermediate state described in this document can be used to move the domain between two parties. This leaves the domain temporarily unsigned and vulnerable to DNS spoofing, but that is preferred over the alternative of validation failures due to a mismatched DS and DNSKEY record. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-dnsop-maintain-ds/ There's also a htmlized version available at: https://tools.ietf.org/html/draft-ietf-dnsop-maintain-ds-04 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-dnsop-maintain-ds-04 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/
- [DNSOP] I-D Action: draft-ietf-dnsop-maintain-ds-… internet-drafts
- Re: [DNSOP] I-D Action: draft-ietf-dnsop-maintain… Paul Wouters
- Re: [DNSOP] I-D Action: draft-ietf-dnsop-maintain… Bob Harold
- Re: [DNSOP] I-D Action: draft-ietf-dnsop-maintain… Matthijs Mekking
- Re: [DNSOP] I-D Action: draft-ietf-dnsop-maintain… Matthijs Mekking
- Re: [DNSOP] I-D Action: draft-ietf-dnsop-maintain… Paul Wouters
- Re: [DNSOP] I-D Action: draft-ietf-dnsop-maintain… Matthijs Mekking
- Re: [DNSOP] I-D Action: draft-ietf-dnsop-maintain… Paul Wouters
- Re: [DNSOP] I-D Action: draft-ietf-dnsop-maintain… Ólafur Guðmundsson
- Re: [DNSOP] I-D Action: draft-ietf-dnsop-maintain… Paul Wouters
- Re: [DNSOP] I-D Action: draft-ietf-dnsop-maintain… tjw ietf
- Re: [DNSOP] I-D Action: draft-ietf-dnsop-maintain… Matthijs Mekking