Subject: comments on draft-ietf-dnsop-resolver-rollover-00.txt

From: "Scott Rose" <[email-masked]>
Date: Mon, 2 Jul 2001 11:44:04 -0400

First, I think this is a good draft to discuss more of the security
maintenance necessary once DNSSEC gets deployed on a larger scale.  However,
there are two points I would like to bring up to the group for discussion:

1.  In section 2.2, the sixth paragraph states that "During a PC-rollover [a
delegated child conducts a key rollover] the old and the new key have to
coexist in the zone and the zone must be signed with both the old and new
keys so that end-users..."  Should this "must" be a "MUST"?  I think it
would stress a key part of this feature, and would be necessary.

2.  The draft should stress that this rollover transaction should only be
used for scheduled KEY rollover.  An emergency rollover (compromised key)
would require more timely interaction and some out of band communication for
both the PC and SE rollovers.  Hard-nosed security folk will be quick to
jump on this point.

Scott

===============================================================
Scott Rose
Advanced Network Technologies Division
NIST

ph: 301-975-8439                       fax: 301-590-0932
http://www.nist.gov
===============================================================