Subject: Fwd: Re: NOTIFY + SIG(0) + DS => secure parent update?

From: Edward Lewis <[email-masked]>
Date: Thu, 19 Jun 2003 09:42:46 -0400

This was part of a private discussion a few weeks ago, and it was 
suggested that this appear on the list before the next edit of SEP 
comes out.

>Date: Fri, 30 May 2003 14:02:31 -0400
>To: a bunch of folks
>From: Edward Lewis <[email-masked]>
>Subject: Re: NOTIFY + SIG(0) + DS => secure parent update?
>
>Quoting the -06 version's intro, which seems to have fallen out of 
>the -07 (my fault):
>
>#  There is a need to differentiate between a KSK and a ZSK by the zone
>#  administrator.  This need is driven by knowing which keys are to be
>#  sent for DS RRs, which keys are to be distributed to resolvers, and
>#  which keys are fed to the signer application at the appropriate time.
>
>That is the requirement motivating the draft.  Evidently it needs to go back
>in.

Here are some other comments:

>The DNS protocol is not just exchanged between resolvers (which, when
>architecturally dissected reveals, e.g., the verifier) and servers (which
>can similarly be dissected to reveal the authoritative data storage).  The
>SEP flag is to be of no interest to the flow between the verifier and the
>authoritative data store.
>
>The SEP flag is important in the flow into the signer application and then
>from the signer to resolver configuration and signer to the parent's key
>collector.  These flows are not well automated, so it may not be obvious.

-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                            +1-703-227-9854
ARIN Research Engineer

...as graceful as a blindfolded bull in a china shop...

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>