Subject: RE: on-offline keys : was RE: Delegation Signer Resource Record

From: Edward Lewis <[email-masked]>
Date: Thu, 31 Oct 2002 11:03:06 -0800

At 13:26 -0500 10/31/02, Loomis, Rip wrote:
>Not sure I grok your use of the common words weak/strong and safe/unsafe
>in this context.  If both halves of the ZSK pair are online (the public

I grok your nongrok.  I switched terminology on purpose.  By 
safe/unsafe, I mean:
     safe = private key is not vulnerable to a break in host security
     unsafe = private key is at risk of a break in host security
- in this context.

Safe/unsafe are terms I just applied in the last mail because (IMHO) 
they are more descriptive than strong/weak.  The terms strong/weak 
were the poorly chosen words used way back then, with strong=safe, 
and weak=unsafe.

>
>I think we're actually more-or-less in violent agreement...
>

Yes.

-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                          +1-703-227-9854
ARIN Research Engineer

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Derek Atkins <[email-masked]>
Date: 31 Oct 2002 13:55:46 -0500

"Loomis, Rip" <[email-masked]> writes:

> on ZSKs and the SIG on ZSKs is going to be on the order of 5-10 minutes
> max, in a perhaps futile attempt to force quicker cache coherency
> following a ZSK compromise.  TTL for other records/SIGs could, and
> probably should, be more like the typical 5-7 days of today.)

If you have a SIG record with 5-7 day TTL and a KEY record with a 5-10
minute TTL, you run the risk of creating invalid signatures if you
remove the old KEY record too soon.  In particular, when you roll over
the ZKS, you MUST keep the OLD KEY around for another <MAX TTL> period
of time.

Granted, it is still safe to keep the KEY-RR TTL rather low, but that
doesn't mean you can _remove_ the key any faster than your
"outstanding" records.

But I think you knew that.. ;)

-derek
-- 
       Derek Atkins
       Computer and Internet Security Consultant
       [email-masked]             www.ihtfp.com