Subject: Re: draft-ietf-dnsext-delegation-signer-00

From: Roy Arends <[email-masked]>
Date: Mon, 02 Jul 2001 07:17:03 -0700

On Thu, 28 Jun 2001, Miek Gieben wrote:

> [On 27 Jun, 2001, Roy Arends wrote in " Re: draft-ietf-dnsext-delegation-signer-00 "]
> > I would like to see some discussion on the idea of having a
> > key-authentication-key (a master-key signs several production keys), this
> > in light of "DS points to key that signs the keyset" vs "DS points to key
> > that signs the child zone".
> > 
> > In general there are 3 proposals now. DS, SIG@parent and the current
> > SIG@child. As I see it, DS is an alternative to SIG@parent, with less of
> as the author of sig@parent i must say, i like the idea of DS (let's
> stick with that name)
>
> > the operational problems SIG@parent has. Next to that, the proposed
> > master/production key scheme is interesting.
>
> agreed interesting, but it adds another level of complexity, do we
> want that?  

It's a trade-off. A longer verification chain VS more frequent rollover. I
favor a "less frequent rollover" and deal with the longer verification
chain. I'm not sure though how more complex the resolver algorithm would
be.

Regards

Roy Arends
Nominum.

to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.

---

From: Miek Gieben <[email-masked]>
Date: Tue, 03 Jul 2001 04:04:48 -0700

[On 02 Jul, 2001, Roy Arends wrote in " Re: draft-ietf-dnsext-delegation-signer-00 "]
> chain. I'm not sure though how more complex the resolver algorithm would
i'm not only talking about the resolver complexity, we can deal with
that. The thing i'm a little bit worried about is how do we explain
this all to the common man...you have production keys, zone keys, 
host keys. Aren't we making it a bit too difficult?

grtz Miek
NLnet Labs

---

From: "Scott Rose" <[email-masked]>
Date: Tue, 03 Jul 2001 08:08:38 -0700

> host keys. Aren't we making it a bit too difficult?

There is a learning curve on something that was more simple, but it is not
too difficult (the fact that things had worked at the workshops point to
that).  Most DNS admins will be able to manage zone and host keys, but I
doubt most small operators will even bother with production keys.  I doubt
most part-time admins will even bother rolling keys over on a set schedule,
unless easy to use tools are made available.

my $.02 ($.012 after taxes)
Scott

---

From: Edward Lewis <[email-masked]>
Date: Wed, 04 Jul 2001 10:19:50 -0700

>chain. I'm not sure though how more complex the resolver algorithm would

Is a longer verification acceptable to folks?  Remember that there are a
lot of resolutions versus zone changes today.  The RSA-MD5 algorithm is
prefered because it is cheaper to verify than sign - based on the
assumption that resolution happens more often.

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                                NAI Labs
Phone: +1 443-259-2352                      Email: [email-masked]

You fly too often when ... the airport taxi is on speed-dial.

Opinions expressed are property of my evil twin, not my employer.