Subject: Nominet position paper about Signing the Root.

From: Roy Arends <[email-masked]>
Date: Mon, 29 Oct 2007 10:52:02 -0700

Fellow IETF-ers.

We (Nominet) have published a position paper that examines the issues  
currently preventing widespread adoption of DNSSEC with a special  
focus on the issues involved in signing the root zone. We also  
suggest a solution to signing the root that we believe balances the  
requirements of all those affected.

The paper can be found here:

http://www.nominet.org.uk/digitalAssets/25692_Signing_the_Root.pdf

You can find the announcement here:
http://www.nominet.org.uk/news/latest/?contentId=4549

With kind regards,

Roy Arends
Senior Researcher
Nominet UK

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: Thierry Moreau <[email-masked]>
Date: Mon, 29 Oct 2007 13:36:54 -0500

Dear Roy and IETF-ers:

A quick reaction to this document:

Good contribution: at last there is a documented proposition for the 
view that DNSSEC root signature is strictly a technical management issue.

This document uses a two-tiered organization for root key management, 
respectively handling the KSK private keys and ZSK private keys for 
signature operations. Such a two-tiered organization is deemed to be 
present in the final solution.

Maybe a difficulty lies in the selection of RZM as one of the two tiers. 
The document author(s) should check if a current project at IANA is 
indeed to integrate the RZM function in IANA operations. In view of the 
possible merger of IANA and the RZM function, the document author(s) 
should state what minimal conditions, in terms of institutional 
independence, they expect between the two tiers of control over the 
DNSSEC root keys.

Regards,

-- 

- Thierry Moreau

CONNOTECH Experts-conseils inc.
9130 Place de Montgolfier
Montreal, Qc
Canada   H2M 2A1

Tel.: (514)385-5691
Fax:  (514)385-5900

web site: http://www.connotech.com
e-mail: [email-masked]