Subject: [DNSOP] Request for Adoption: draft-larson-dnsop-trust-anchor-02.txt

From: Peter Koch <[email-masked]>
Date: Mon, 3 Dec 2007 22:52:23 +0100

Dear WG,

we've done this twice now in face to face meetings, but let's double check on
the list:

There is a request to adopt <draft-larson-dnsop-trust-anchor-02.txt>
"DNSSEC Trust Anchor Configuration and Maintenance" as a DNSOP WG item.
The topic is covered by our charter.

Now is the time to support or oppose adoption as a WG item.  Volunteering
on the record for review and/or contribution would also be welcome.
Given the support in the room earlier today, silence will default to "yes".

The deadline is Friday, DEC 14.

-Peter

_______________________________________________
DNSOP mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dnsop

---

From: Paul Wouters <[email-masked]>
Date: Mon, 3 Dec 2007 18:57:48 -0500 (EST)

> The topic is covered by our charter.

	This document RECOMMENDS that a trust anchor be specified as a DS RR.

[...]

	Using a DS RR is also recommended because it is smaller than the
	DNSKEY RR and is easier to enter manually, either by typing or
	cutting and pasting.

I do agree with this, since multiple copy and paste with spaces in the DNSKEY
record, is a real pain. I'm doing these things now between BIND, ldns,
dnssec-tools and firefox plugins, and I frequently break things.

	3.  Verify that the DNSKEY RR corresponding to the configured DS RR
	(i.e., the DNSKEY whose hash appears in the DS record) appears in
	the DNSKEY RRSet and that the DNSKEY RR has the Zone Key Flag
	(DNSKEY RDATA bit 7) set.

I had to re-read RFC4034 to make that this did not mistakenly mean "zone
signing key". Perhaps it can be slightly rephrased to avoid confusion
between "zone key flag" and "zone signing key"?

One problem I can see is that DS records live at the parent of the
zone, while in this use, one needs the DS record specifying the current
zone. This might be confusing.

This might also be confusing if one wants to load DLV keys. Do we then
need to use a DLV record or a DS record?

As for whether this should be a consideration at all for the working
group, I am unsure. It seems a non-ietf, software vendor issue, but on
the other hand, using one format between the 4 pieces of software I now
use that requires this information, would be a bonus.

Paul

---

From: Paul Wouters <[email-masked]>
Date: Mon, 3 Dec 2007 18:57:48 -0500 (EST)

[...]

Paul

---

From: Scott Rose <[email-masked]>
Date: Fri, 14 Dec 2007 11:42:52 -0500

> Given the support in the room earlier today, silence will default to "yes".

I support adoption of the draft.  I will also volunteer as a reviewer.

Personally, I don't have a firm stance on storing the trust anchor as a
DS or DNSKEY RR (or simply using the format).  It would depend on the
software and platform.  Having a RECOMMEND storage doesn't seem to hurt
though.

Scott

-- 
----------------------------------------
Scott Rose            Computer Scientist
NIST
ph: +1 301-975-8439
[email-masked]

http://www-x.antd.nist.gov/dnssec
http://www.dnsops.gov/
-----------------------------------------

---

From: Scott Rose <[email-masked]>
Date: Fri, 14 Dec 2007 11:42:52 -0500

Scott