Re: Notes on DNSSEC key rollover

[Thierry Moreau <[e-mail]>]

Eric Rescorla wrote:
> 
> I've taken a look at the various dnsext key rollover [...]
> 

Thanks for sharing this fresh look at this issue.

> ROLLOVER
> --------
> [...]
> 
> The natural way to handle automatic rollover for non-compromised
> keys is simply to have each key have an expiry date and for
> K_n to sign K_n+1 well before it expires. This has an obvious
> problem when what you're worried about is compromise of key
> K_n, since any signature from K_n is inherently untrustworthy.
> 
> The classic approach to dealing with this problem is to have
> two keys:
> 
> 1. An operational key which is used to sign data.
> 2. A high-assurance key which is only used to sign operational
>    keys.
> 
> [...]
> 
> This is sort of similar to the ZSK/KSK split in DNSSEC but it's not
> entirely clear to me if people intend the KSKs to have very long
> lifespans and to be used very infrequently, which is what's required by
> this security model. In particular, it appears from the various documents
> that people intend to be able to rollover compromised KSKs, which
> cuts against that theory.
> 

Not exactly. The security model for -timers (and perhaps -threshold as 
well) is more or less that K_n, *when or soon after it becomes 
"operational"*, signs K_n+1 which becomes "operational" at the end of 
operating period for K_n. These are all KSKs (to the extent that KSK/ZSK 
separation is present and relevant). The security strength is based on 
the assumption that private key compromise is less likely at the 
beginning than at the end, of the operational period.

(In a previous post, I wrote "The incremental security in moving from 
the Paul Vixie approach to either -threshold or -timers is marginal ..." 
a comment which I consider unjustified now since I understand the 
-timers security model as explained in the previous paragraph.)

The classic approach you describe is not reflected in any DNSEXT proposal.

The TAKREM approach (draft-moreau-dnsext-sdda-rr, 
draft-moreau-dnsext-takrem-dns) is based on pre-announcements of a 
series of fingerprints for future keys.

Regards,

-- 

- Thierry Moreau

CONNOTECH Experts-conseils inc.
9130 Place de Montgolfier
Montreal, Qc
Canada   H2M 2A1

Tel.: [phone]
Fax:  [phone]

web site: http://www.connotech.com
e-mail: [e-mail]


--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>