Subject: dnssec key manglement

From: Randy Bush <[email-masked]>
Date: Mon, 15 Oct 2001 18:52:54 -0700

from a discussion with a secret friend :-)

> current techniques are oob via a web page or email.  these do not
> do well for frequent re-keying.  i am not sure if this has been
> thought out at any scale.

This is a good time to think it out:

   DS is a lot simpler keying scenario to manage
   than sig@child

   Maybe there's a simple key exchange protocol buried
   in IKE or coming in JFK that can be used to meet dnssec
   requirements.

randy

to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.