Subject: Re: [stir] DNS for STIR: draft-kaplan-stir-cider-00.txt

From: Dave Crocker <[email-masked]>
Date: Thu, 01 Aug 2013 09:11:37 +0200

On 7/30/2013 9:29 PM, Hadriel Kaplan wrote:
> in such a case there might be two or more public keys in the DNS for the same E.164 phone number, but under different "key index" names and thus separate TXT RR entries.

To emphasize these design features a bit more:

Key management:

      The "index" (what DKIM calls "selector") is an administrative 
"adjective" to the registered, visible value (in this case the telephone 
number.)  It's added to the value, so that there can be multiple keys 
associated with a single value.  The value is what is seen and what is 
used for making reputation assessments, but the DNS lookup string has 
the index added to it, to permit accessing different DNS records 
associated with the value.

      Having multiple keys makes it convenient to roll over to new ones 
while still supporting old ones, if there is a desire to limit the 
window of exposure for individual keys.

      It also permits multiple, independent signers for the same value 
(number), with each being given permission that can be independently 
controlled by whoever has the 'master' authority over key management. 
Individual permission can be delegated and the permission can then be 
terminated at any time, by simply removing that index's DNS entry.  This 
removal takes effect within DNS cache TTL time and obviates the need for 
a distinct certificate revocation mechanism.

Administrative choice:

    As Hadriel notes, there are multiple ways to organize basic 
authority over key management, specific authority to upload individual 
public keys and specific authority to sign with the individual private 
keys.  This group has already debated some authority choices a bit and 
I'm sure there will be more. The CIDER approach might or might not 
permit /all/ variations of administrative choice, but it certainly 
permits a number of them.

d/

-- 
Dave Crocker
Brandenburg InternetWorking
bbiw.net