Subject: [DNSOP] I-D Action: draft-ietf-dnsop-rfc4641bis-09.txt

From: [email-masked]
Date: Tue, 14 Feb 2012 02:46:28 -0800

A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Domain Name System Operations Working Group of the IETF.

	Title           : DNSSEC Operational Practices, Version 2
	Author(s)       : Olaf M. Kolkman
                          W. (Matthijs) Mekking
	Filename        : draft-ietf-dnsop-rfc4641bis-09.txt
	Pages           : 70
	Date            : 2012-02-14

   This document describes a set of practices for operating the DNS with
   security extensions (DNSSEC).  The target audience is zone
   administrators deploying DNSSEC.

   The document discusses operational aspects of using keys and
   signatures in the DNS.  It discusses issues of key generation, key
   storage, signature generation, key rollover, and related policies.

   This document obsoletes RFC 4641 as it covers more operational ground
   and gives more up-to-date requirements with respect to key sizes and
   the DNSSEC operations.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-dnsop-rfc4641bis-09.txt

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

This Internet-Draft can be retrieved at:
ftp://ftp.ietf.org/internet-drafts/draft-ietf-dnsop-rfc4641bis-09.txt

---

From: Matthijs Mekking <[email-masked]>
Date: Tue, 14 Feb 2012 11:50:12 +0100

Hi WG,

Review from Stephen and Peter resulted in a new version of DNSSEC
Operational Practices, Version 2. Besides editorial changes, the most
important changes are:

* The third school of thought for rolling a KSK that is not a trust
anchor (in section 3.2.1), that it should only be done when it is
known or strongly suspected that the key can be or has been
compromised, is extended with: or when a new algorithm or key storage
is required.

* In section 4.1.1.2 on Double Signature Zone Signing Key Rollover, a
recommendation on the duration on the "new DNSKEY" phase was removed,
it was being too conservative.

* Section 4.3.5.1. on Cooperating DNS operators adds clarifying text
for Figure 9: Rollover for cooperating operators.

* An additional, clarifying diagram for the alternative approach on
rollover for cooperating operators is given in Figure 14, Appendix D.

Best regards,
  Matthijs

On 02/14/2012 11:46 AM, [email-masked] wrote:
> 
> A New Internet-Draft is available from the on-line Internet-Drafts
> directories. This draft is a work item of the Domain Name System
> Operations Working Group of the IETF.
> 
> Title           : DNSSEC Operational Practices, Version 2 Author(s)
> : Olaf M. Kolkman W. (Matthijs) Mekking Filename        :
> draft-ietf-dnsop-rfc4641bis-09.txt Pages           : 70 Date
> : 2012-02-14
> 
> This document describes a set of practices for operating the DNS
> with security extensions (DNSSEC).  The target audience is zone 
> This document obsoletes RFC 4641 as it covers more operational
> ground and gives more up-to-date requirements with respect to key
> sizes and the DNSSEC operations.
> 
> 
>  _______________________________________________ DNSOP mailing
> list [email-masked] https://www.ietf.org/mailman/listinfo/dnsop