Subject: Re: dnssec key manglement

From: Edward Lewis <[email-masked]>
Date: Tue, 18 Dec 2001 17:34:07 -0500

This is something that I've spent a lot more time thinking about in the
past month.  A couple of us talked about this at the IETF, but much more
consideration is needed.

One of the factors to consider is that there may not be one (mechanical)
answer to this problem.  I am fully aware that we are not here to touch
ICANN subject matter, but the ICANN architecture of registrars and registry
may require a solution that is "richer" than less complex environments.
(I'm stating this as objectively as I can, I do not mean to launch a debate
on ICANN or whether we should engineer to meet the needs of any
organization.)

I don't know if we want to discuss this topic on the namedroppers list
right now, so I'll refrain from rambling on about initial thoughts.
Suffice it to say that I am motivated by a funder (which is non-ICANN) to
look into this and will be.  If anyone wants to discuss this (further), I'm
willing.

At 8:52 PM -0500 10/15/01, Randy Bush wrote:
>from a discussion with a secret friend :-)
>
>> current techniques are oob via a web page or email.  these do not
>> do well for frequent re-keying.  i am not sure if this has been
>> thought out at any scale.
>
>This is a good time to think it out:
>
>   DS is a lot simpler keying scenario to manage
>   than sig@child
>
>   Maybe there's a simple key exchange protocol buried
>   in IKE or coming in JFK that can be used to meet dnssec
>   requirements.

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                                NAI Labs
Phone: +1 443-259-2352                      Email: [email-masked]

Opinions expressed are property of my evil twin, not my employer.

to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.