Subject: [dnsop] DOP #3: Chain of trust text

From: "Olaf M. Kolkman" <[email-masked]>
Date: Mon, 13 Jun 2005 14:14:15 +0200

Also see thread starting at:
  http://darkwing.uoregon.edu/~llynch/dnsop/msg03465.html

In a discussion between Olaf and Ed, Ed was the last to reply: 
> >>  #2.  Keeping the Chain of Trust Intact
> >>
> >>  #   For the verifying clients it is important that data from secured
> >>  #   zones can be used to build chains of trust regardless of whether the
> >>  #   data came directly from an authoritative server, a caching nameserver
> >>  #   or some middle box.  Only by carefully using the available timing
> >>  #   parameters can a zone administrator assure that the data necessary
> >>  #   for verification can be obtained.
> >>
> >>  I don't think that the last sentence is right.  If an admin is 
> >>unaware of the
> >>  timing parameters, data will only be delayed.
> >
> >Let me try to reprhasese that last sentence.
> >
> >Only by carefully timing their actions zone administrators can
> >assure that the data necessary for verification can be obtained by
> >validating clients.
> 
> I think that the sentence is too ambiguous to be useful.  "Carefully 
> timing" sounds like there is much to be fearful of, without defining 
> the concerns.
> 
> How about...
> 
> DNS has inherent delays in the propagation of data, e.g., from the 
> master to slave, caches timing out old copies before retrieving fresh 
> authoritative data.  Because of this administrators need to prepare 
> for changes in advance and sequence actions appropriately to achieve 
> smooth transitions.  Preparations include adjusting the TTL of 
> records and RRSIG expirations.  Sequencing has to account for the 
> worst case scenarios of data laying in compliant caches.
> 
> ...that should be a high level description of the problem.
> 
> >----------------------------------------------------------------------

I concur, I've redistributed the text a bit to read the following:

2.  Keeping the Chain of Trust Intact

   DNS has inherent delays in the propagation of data, e.g., from the
   master to slave, caches timing out old copies before retrieving
   fresh authoritative data.  

   For the verifying clients it is important that data from secured
   zones can be used to build chains of trust regardless of whether the
   data came directly from an authoritative server, a caching nameserver
   or some middle box.  

   Because of this administrators need to prepare for changes in
   advance and sequence actions appropriately to achieve smooth
   transitions.  Preparations include adjusting the TTL of records and
   RRSIG expirations.  Sequencing has to account for the worst case
   scenarios of data laying in compliant caches.

--Olaf
.
dnsop resources:_____________________________________________________
web user interface: http://darkwing.uoregon.edu/~llynch/dnsop.html
mhonarc archive: http://darkwing.uoregon.edu/~llynch/dnsop/index.html