Subject: [dnsext] dnssec-bis updates: key use

From: "W.C.A. Wijngaards" <[email-masked]>
Date: Mon, 03 Aug 2009 11:17:08 +0200

Hi David,

About dnssec-bis updates.  Specifically about the 'MUST try all keys'.

a) I disagree. Are there people that agree with this point of view?

A more specific key is simply more specific and thus trumps a less
specific one.  People should have proper automated key update mechanisms
so the only way for the key to not work is if there is an attack.

So, the text must be:
  MUST try all keys that are specific for the query.

So, if you add 5 keys for example.com they should all be tried.

b) In case I lose the argument I want the text amended:

MUST try all keys, but a chain of trust from a higher up key
MUST result in a secure state for the name of the closest key.

So, that if 'example.com' does not work, and you use the root key,
then insecure com delegations do not downgrade security.
The higher key MUST then build a chain of trust to the lower name.

Best regards,
   Wouter

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>