Subject: Re: Survey of Rollover Mechanisms

From: "Olaf M. Kolkman" <[email-masked]>
Date: Fri, 7 Oct 2005 11:22:37 +0200

On Sep 23, 2005, at 18:31 , Thierry Moreau wrote:

> Dear all:
>
> In order to assist the discussion, here is a survey of
> trust anchor key mechanisms.

Thanks Thierry,

To my embarrassment I have to confess I had not seen your message  
until today. I think it is a useful addition to the
pointed questions I mailed to the list the other day.

<no hats>
You wrote:
> 5. Out-of-band Validated Rollover
>
> Description: the "textbook" rollover method is to
> distribute the key to DNS resolvers and use an out-of-
> band channel to let the end-users validate the new key.
> There isn't the slightest chance that this is
> operationally feasible in any context.

Why isn't there the slightest change?

And what is exactly the between "Out of band Validated Rollover"   
difference to "The outside certification" option, isn't
the latter one of the variations on the general theme of out-of-band  
validated rollovers

<no hats>

--Olaf

-----------------------------------------------------------
Olaf M. Kolkman
NLnet Labs
http://www.nlnetlabs.nl/