Subject: In-Band Rollover and Out-Of-Band Priming

From: "Olaf M. Kolkman" <[email-masked]>
Date: Tue, 13 Jul 2004 14:16:39 +0200

This is a heads up for: draft-kolkman-dnsext-dnssec-in-band-rollover-00:
http://www.ietf.org/internet-drafts/draft-kolkman-dnsext-dnssec-in-band-rollover-00.txt

Abstract

   The DNS Security Extensions (DNSSEC) works by validating so called
   chains of authority.  The start of these chains of authority are
   usually public keys that are anchored in the DNS clients, the so
   called trust anchors.

   This memo describes a method how these client trust anchors can be
   replaced using the DNS validation and querying mechanisms (in-band)
   if the key pairs used for signing by zone owner are rolled.

   This memo also describes a method to establish the validity of trust
   anchors for initial configuration, or priming, using out of band
   mechanisms.

This will be on the agenda of Thuesday slot. 

-- Olaf
   Co-author

---------------------------------| Olaf M. Kolkman
---------------------------------| RIPE NCC

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Masataka Ohta <[email-masked]>
Date: Tue, 13 Jul 2004 22:49:44 +0900

Olaf;

> This is a heads up for: draft-kolkman-dnsext-dnssec-in-band-rollover-00:

Why do we need rollover?

What kind of attack is assumed to be protected against?

Depending on the assumed attack, it may be better just to have
a single long key forever than having multiple short ones.

							Masataka Ohta