Subject: Re: DNSSECbis Q-12: Support for multiple preconfigured public keys in a security-aware resolver

From: Miek Gieben <[email-masked]>
Date: Tue, 15 Jul 2003 13:06:52 +0200

[On 15 Jul, @11:46, Matt wrote in "DNSSECbis Q-12: Support for mu ..."]
> Suggested text: It is reasonable to assume the need for multiple
> trusted public keys during initial DNSSEC deployment as various
> portions of the name space become secured.  A resolver that supported
> only a single trusted public key would constrain its users.
> Therefore, the following text is suggested:
> 
>    A security-aware resolver MUST be capable of being preconfigured with
>    multiple trusted public keys.

I support this,

grtz Miek

--
NLnet Labs

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Roy Arends <[email-masked]>
Date: Tue, 22 Jul 2003 12:53:52 +0200 (CEST)

On Tue, 15 Jul 2003, Matt Larson wrote:

> This question corresponds to editor's note #11 from
> draft-ietf-dnsext-dnssec-protocol-01.
>
> Q-12: Should support for configuring multiple trusted public keys in a
> security-aware resolver be a MUST rather than a SHOULD?
>
> Background: Here is the text in question from Section 4 (page 22) of
> draft-ietf-dnsext-dnssec-protocol-01:
>
>    at least one trusted public key, and SHOULD be capable of being
>    preconfigured with multiple trusted public keys.  Since a security-
>    aware resolver will not be able to validate signatures without such a
>    preconfigured trusted key, the resolver SHOULD have some reasonably
>    robust mechanism for obtaining such keys when it boots.
>

I support the suggested change.

Roy

---

From: Rob Payne <[email-masked]>
Date: Tue, 22 Jul 2003 07:42:45 -0400

>    multiple trusted public keys.

I support this text.

				 -rob

---

From: "Scott Rose" <[email-masked]>
Date: Tue, 22 Jul 2003 14:51:16 -0400

To keep the text in line with a previous consensus - it should read "public
key or DS RR" instead of just the public key.  Minor change, but bring it in
line with the possibility that a resolver could be configured with multiple
DS RRs instead of public keys.

Scott

----- Original Message ----- 
From: "Roy Arends" <[email-masked]>
To: "Namedroppers Mailing List" <[email-masked]>
Sent: Tuesday, July 22, 2003 6:53 AM
Subject: Re: DNSSECbis Q-12: Support for multiple preconfigured public keys
in a security-aware resolver

---

From: Roy Arends <[email-masked]>
Date: Wed, 23 Jul 2003 16:36:22 +0200 (CEST)

> DS RRs instead of public keys.

I agree, and a note that a mix of DS/KEY is possible as well.

Roy