[renum] Key management [draft-liu-6renum-gap-analysis-03]

[Brian E Carpenter <[e-mail]>]

On 2011-12-10 11:45, Mark Andrews wrote:
> In message <[e-mail]>, Ran Atkinson write
> s:

...
>>>> I think the problems with key management deserve their
>>>> own subsection in Section 10 -- as a category of "gap"
>>>> that ought to be addressed.  That new subsection ought
>>>> to note the operational issues with key provisioning
>>>> and key management for Secure Dynamic DNS Update
>>>> (at least for non-MS nodes) and equally or more so
>>>> for Secure DHCPv6 and SEND.  One would hope these
>>>> would not fall into the "unsolvable gap" category,
>>>> but in any event these gaps do need to be clearly
>>>> documented.

>>> The key management is a complicated issue. It is worth
>>> a separated draft. It is relevant. However, we don't
>>> think it is a renumbering specific issue.  We will add
>>> some new text for it. But we would like to leave it out of scope.
>> I do not think that ignoring the issue or declaring it
>> out-of-scope is a legitimate position to take for this
>> document.
>>
>> IETF rules require that ALL documents must fully address
>> Security Considerations *within their own document*.
>>
>> Ignoring that topic -- or shunting it off to other
>> documents -- will result in a Last Call objection from me 
>> and possibly others on the very solid technical grounds
>> that the Security Considerations are known to be deficient.

Right, but the question is what can we say about key management
that is specific to enterprise renumbering? We can explain the
problem, but this is presumably not the WG where a solution should
be developed.

> With Windows you add the machine to the domain.  This is a
> one off procedure and the last time I did it this it needed
> a domain administrators password if my memory is correct.
> 
> Initial registration doesn't necessarially need to be standardised.
> It can be ad-hoc.  Log into a web page and it can return a TSIG 
> which is configured into the nameserver and the client machine.
> 
> That's done all the time to secure zone transfers.
> 
> What need to be standardised is what goes on the wire and that
> was done years ago.  The rest really is implementation detail.

Really? It seems to me that the Windows solution will only work for
a Microsoft shop, not for a heterogeneous enterprise network.

   Brian