Subject: Continuing the work on key-rollover

From: "Olaf M. Kolkman" <[email-masked]>
Date: Thu, 30 Mar 2006 09:56:32 +0200

Dear Colleagues,

After Re-issuing issue 1 [1] and asking for a hum at the physical  
meeting I plan to close the issue next week and ask the editors to  
add the text.

No other issues have been brought up. If you have any other issues or  
requirements then please speak up next week[*]. The editors promised  
to stay on top of the document (by volunteering Suresh for the job,  
thanks!).

I hope that Suresh can whip up a new revision in a week or two and if  
there are no further comments we'll last call it.

In the mean time, please look at the various proposals on the table.  
The document that Alberto Martínez Herrera provided to us in November 
[2] might, or even will, be useful. (URL: http:// 
docs.nicmxlabs.org.mx/itesm/dnsseckeyrolloverproposals.pdf).  There  
are other people that did comparison matrices, can they please  
provide links?

If there are folk that have any other rollover-proposals to add then  
please submit that seem to fit to the requirements; better start  
writing text but please do realize that you add entropy :-) .

I hope we can converge to one spec before next IETF.

--Olaf

[1] http://ops.ietf.org/lists/namedroppers/namedroppers.2006/ 
msg00370.html
[2] http://ops.ietf.org/lists/namedroppers/namedroppers.2005/ 
msg01546.html

[*] Somebody told me that they would like to see the ability to add   
a 'time-delay' as a property of the rollover scheme. To paraphrase:  
That way one cannot compromise the system and immediately run with  
it. A mala-fide roller will have to sit on the compromised system for  
a while before it can be abused. (I can't recall who mentioned this  
but if somebody supports this requirement, please speak up).

-----------------------------------------------------------
Olaf M. Kolkman
NLnet Labs
http://www.nlnetlabs.nl/