Subject: Re: ISSUE 5: Embedded requirements, was Re: Pending issues for draft-ietf-dnsext-rollover-requirements-00

From: "Olaf M. Kolkman" <[email-masked]>
Date: Thu, 25 May 2006 14:55:12 +0200

While reading up on the ISSUES on the rollover draft (we should try  
to get those to closure) I noticed:

>> DESCRIPTION:
>>
>>    Added the following text to the "Timeliness" requirement:
>>        Operators of security-aware resolvers using RR(s) from that
>>        zone as Trust Anchors need to acquire new and remove revoked
>>        Trust Anchors such that no old key is used for long after
>>        revocation.
>>
>
> I support this requirement in principle, but I am unsure what a  
> "long time
> period" would be.  How about the TTL of the DNSKEY RR?  Just  
> thinking out
> loud, but when a rollover is seen, the old trust anchor should be  
> purged as
> if it were part of the cache at that point.
>

I think that in this context "long" means much much longer than the  
time it took for the TTL to expire. Hard to put a quantitative number  
on but what about "one or two orders of magnitude longer than the SOA  
expiry parameter" or alternatively "during the expected lifetime of  
the zone" (another can of definition worms)

No hats.

--Olaf

-----------------------------------------------------------
Olaf M. Kolkman
NLnet Labs
http://www.nlnetlabs.nl/