Subject: Re: Signature at parent (draft-ietf-dnsop-parent-sig-00.txt)

From: [email-masked] (Ted Lindgreen)
Date: Fri, 6 Apr 2001 15:01:04 +0200

[Quoting John Gilmore, on Apr  6, 14:12, in "Re: Signature at par ..."]

> There's nothing wrong with putting an IPSEC KEY record at the top
> of a zone, along with the zone keys.

The problems with it are:

1. Inflexibility:
    Any change, update, addition, or removal of such a KEY
    needs the involvement of the parent.
2. Cost:
    It will be pretty likely, that TLDs will charge for signing KEYs,
    and probably more when lots of non-zone-KEYs are involved.
3. Liability:
    He, who signs, must make sure that he knows he is signing, and
    must accept some responsibility for it (otherwise the signature
    is worthless). I think a TLD should accept the responsibility for
    a proper delegation of a domain, but I don't think the TLD will
    accept the responsibility for local stuff like IPSEC-KEYS under
    those already delegated domains.

I think that smart zone-administrators keep their local KEYs out of
the apex' KEYset.

But some education may help to get them smart.

So, the question is: in a to be written "Best Current Practice
document" should we be silent about this, or just make a note or
remark, or discourage it, or make it a SHOULD NOT, or perhaps even
a MUST NOT?

I agree with Brian Wellington, that a "SHOULD NOT" will do fine.

Regards,
-- Ted.

to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.

---

From: Peter Koch <[email-masked]>
Date: Fri, 06 Apr 2001 18:32:03 +0200

> 1. Inflexibility: [...]
> 2. Cost: [...]

While I agree with (1) and (2), this statement sounds dangerous. SIG RRs
have a purpose defined and restricted by the "protocol" octet in the
corresponding KEY RR. SIGnatures for DNSSEC purposes provide for data
origin authentication. They do not say anything about applicability or
correctness of the signed data. So, a child's non-zone KEY RR SIGned by
the DNSSEC key of the parent zone is not 'certified' w.r.t. the protocol
it is made for. The normal resolution/verification process would only
accept the child's SIG for the KEY RR, wouldn't it?

-Peter