Subject: [dnsop] EPP-SECDNS: Keys vs. DS proposal

From: Edward Lewis <[email-masked]>
Date: Mon, 27 Dec 2004 09:54:31 -0500

Last week I sent a message about TTL's.  At the same discussion, one 
of the participants (i.e., not me) had another suggestion, regarding 
the DNSKEY vs. DS debate.

The suggestion is to define a DNSKEY as an attribute of the DS element.

The goals of this are to:

1) Allow access to keys where they might not otherwise be, meaning: 
In some situations name servers for delegated zones are not reachable 
by the parent zone's networks.  (Yes, I know that this ought never 
happen, but it's an operational reality.  I have found many of these 
when studying lame delegations.)

2) Encourage deployments to use the DS as the main mode of transfer. 
Meaning:  imagine one registry asking for keys of its registrars and 
another registry asking for DS's of its registrars.  The operational 
nightmare would be if the two sets were distinct for some time and 
then the two communities merged.

3) Removes the need to define a second element (DNSKEY) in the 
protocol, removes the RRSIG completely from the discussion.  By doing 
this, getting the document produced (to RFC as a Proposed Standard) 
will be a shorter effort.

Comments?

-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                                +1-571-434-5468
NeuStar

"A noble spirit embiggens the smallest man." - Jebediah Springfield
.
dnsop resources:_____________________________________________________
web user interface: http://darkwing.uoregon.edu/~llynch/dnsop.html
mhonarc archive: http://darkwing.uoregon.edu/~llynch/dnsop/index.html

---

From: "Scott Hollenbeck" <[email-masked]>
Date: Tue, 28 Dec 2004 20:05:25 -0500

> -----Original Message-----
> From: Edward Lewis [mailto:[email-masked]] 
> Sent: Monday, December 27, 2004 9:55 AM
> To: [email-masked]
> Cc: [email-masked]
> Subject: [dnsop] EPP-SECDNS: Keys vs. DS proposal
> 
> 

This seems like a reasonable compromise to me, Ed.  Does anyone think that
it's not a possible way forward?

-Scott-

.