Subject: Rollover pointed questions.

From: "Olaf M. Kolkman" <[email-masked]>
Date: Wed, 5 Oct 2005 10:09:02 +0200

Dear Colleagues,

We would like to get some forward motion on key management.

With reference to http://ops.ietf.org/lists/namedroppers/namedroppers. 
2005/msg01280.html.
I am opening a new thread and ask  variations of the pointed  
questions that Paul suggested.

For the purpose of this mail there are two angles on the key- 
management issue:
   - Initial distribution of trust-anchors
   - Maintenance of existing trust-anchors, or automatic rollovers.

= Can DNSSEC be deployed without key management protocols?
    * Is either angle of the  key-management issue a tools issue only  
or do we
      need to standardize the behavior on both sides of the wire.
   * Do we need one unique solution?

= Is the trustupdate-timers draft [1] a proposal that provides  
sufficient basis for a rollover
      protocol
    * What essential parts seem to be missing, if any.
        * The requirements for this work have never been spelled out.  
Do you requirements that
           are not being addressed in the draft?
    * Are there competing proposals that provide better solutions?
        * Either because they have no IPR claims or have non- 
restrictive licensing [*]
        * They are better engineered
    * Is [2] an alternative that needs to be kept alive? If so do we  
have a volunteer editor?

=  Should the work on initial distribution of trust anchors be  
continued in this group.
    * Are the requirements for this work clear enough? ... huh..  
which requirements :-)
    * Are the proposals available now (in parts of [2] and in [3])  
sufficient basis for continued work?
    * Is there sufficient commitment to do this work in DNSEXT?
       + Should we spawn off a BOF/WG in order to do this work?

If there is not further discussion we will last call the trust update  
timers draft (shortly after the Vancouver IETF) and propose that no  
further work in DNSEXT is done on the initial distribution of trust  
anchors.

- - --Olaf Kolkman
    DNSEXT co chair.

[1] http://tools.ietf.org/wg/dnsext/draft-ietf-dnsext-trustupdate- 
timers/

[2] http://tools.ietf.org/wg/dnsext/draft-ietf-dnsext-trustupdate- 
threshold/draft-ietf-dnsext-trustupdate-threshold-00.txt

[3] http://ietfreport.isoc.org/idref/draft-laurie-dnssec-key- 
distribution/

  [*] The IPR claim itself is not something we want to discuss.  We  
want to avoid rat holing on licensing discussions so please carefully  
state your arguments and state them only once.

- -----------------------------------------------------------
Olaf M. Kolkman
NLnet Labs
http://www.nlnetlabs.nl/

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>