Subject: [DNSOP] The DNSOP WG has placed draft-wessels-edns-key-tag in state "Candidate for WG Adoption"

From: IETF Secretariat <[email-masked]>
Date: Wed, 04 Nov 2015 18:19:17 -0800

The DNSOP WG has placed draft-wessels-edns-key-tag in state 
Candidate for WG Adoption (entered by Tim Wicinski)

The document is available at
https://datatracker.ietf.org/doc/draft-wessels-edns-key-tag/

---

From: Bob Harold <[email-masked]>
Date: Thu, 5 Nov 2015 12:01:58 -0500

On Wed, Nov 4, 2015 at 9:19 PM, IETF Secretariat <
[email-masked]> wrote:

> I freely admit to not being an expert on DNSSEC.  Some questions, if they
make sense:

5.2.1 - If the Stub Resolver is validating, then perhaps the recursive
resolver should just pass the stub resolver's list of keys, so the Auth
server knows whether the stub can validate with the new keys?  The
Recursive will likely send other queries with its own key set, so the Auth
server can get both sets of information - but will it understand the
difference, or should we send forwarded keys separately?

In general, this lets us know that some servers have the new key, but is
there any way in the process where we can mark a key as 'old' but still
usable and wait until resolvers quit sending it, before we remove it?  Or
is that too complicated?

-- 
Bob Harold

---

From: Mark Andrews <[email-masked]>
Date: Fri, 06 Nov 2015 10:11:35 +1100

> usable and wait until resolvers quit sending it, before we remove it?  Or

You don't need to wait for resolvers to stop using a key.  You only
need to wait until they are using the new key.

If we have multiple instances of the option in opt record.

e.g.
	TAG <old>  TAG <old> <new>  TAG <new>

then you wait for "TAG <old>" to disappear from the incoming queries
before removing the old key.

e.g.
	TAG <old> <new>  TAG <new>

Now to get counts you need resolvers to count the unique clients
including themselves seen over a period and include those numbers
as well.

	TAG <count> <keyid> ....

If you have the union you get this sort of pattern

	TAG <old>
	TAG <old> <new>
	TAG <new>

And you don't know when you can safely withdraw the old key.

If you have the intersection get this sort of pattern

	TAG <old>
	TAG 				The intesection set is empty
	TAG <old> <new> or TAG <new>
	TAG <new>

Mark

-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]