Subject: Re: [DNSOP] Trust History draft

From: Florian Weimer <[email-masked]>
Date: Mon, 05 Oct 2009 06:52:49 +0000

* W. C. A. Wijngaards:

> Hi,
>
> Just new in the dnsop wg tools page:
> http://tools.ietf.org/html/draft-wijngaards-dnsop-trust-history-00

I don't understand this part:

| DNSSEC [RFC4034] validators that have been offline or have missed an
| (emergency) rollover can use trust history service to get back on
| track.  The trust history location is assumed available from the
| validator configuration.  The validator then fetches old DNSKEY
| RRsets and checks they form a chain to the latest key.

Doesn't this defeat the purpose of key rollovers?

-- 
Florian Weimer                <[email-masked]>
BFK edv-consulting GmbH       http://www.bfk.de/
Kriegsstraße 100              tel: +49-721-96201-1
D-76133 Karlsruhe             fax: +49-721-96201-99

---

From: "W.C.A. Wijngaards" <[email-masked]>
Date: Mon, 05 Oct 2009 09:05:11 +0200

Hi Florian,

> Doesn't this defeat the purpose of key rollovers?

No it doesn't.  Key rollovers remain effective completely
for computers that are online at the time of rollover.
This is as effective as key rollover is today.

The draft proposes a way for computers that were offline
during the key rollover to get back on track.  They way
it is done, makes them all get back on track using the
most recent keys they had.  So that the 'oldest key' is
the least old as possible.

Thus the key rollover is aimed for, but with the computers
being offline, the best you can do, is have them 'roll over'
in larger steps.  This being the step from 'their most
recent keys' to the 'current key when they go online'.

Of course, in reality, this turns into a distribution of
computers, each with older and older keys and have been
offline for longer and longer.  There were concerns
expressed about limiting that to some maximum, and this
has been addressed in a more recent version of the draft.

Best regards,
   Wouter