Subject: Re: [dnsop] I-D ACTION:draft-ietf-dnsop-key-rollover-requirements-02.txt

From: Gilles Guette <[email-masked]>
Date: Thu, 20 Jan 2005 09:07:16 +0100

Hello,
the new version of the draft is now available. We have taken into 
account remarks, principally these from samuel Weiler and Rip Loomis, 
and include a document changes section.

Please consider that any point in this draft are not fixed. Indeed, we 
(the authors) think that the way to do the key rollover (in-band, out-of 
band or both) must be discussed to  solve problem that can occur and 
find what must be written in the draft.

Regards

[email-masked] wrote:

> A New Internet-Draft is available from the on-line Internet-Drafts 
> directories.
> This draft is a work item of the Domain Name System Operations Working 
> Group of the IETF.
>
>     Title        : Requirements for Automated Key Rollover in DNSsec
>     Author(s)    : G. Guette, O. Courtay
>     Filename    : draft-ietf-dnsop-key-rollover-requirements-02.txt
>     Pages        : 8
>     Date        : 2005-1-19
>     
> This document describes problems that appear during an automated
>   rollover and gives the requirements for the design of communication
>   between parent zone and child zone during an automated rollover
>   process.  This document is essentially about in-band key rollover.
>
> A URL for this Internet-Draft is:
> http://www.ietf.org/internet-drafts/draft-ietf-dnsop-key-rollover-requirements-02.txt 
>
>
> To remove yourself from the I-D Announcement list, send a message to 
> [email-masked] with the word unsubscribe in the body of 
> the message.  You can also visit 
> https://www1.ietf.org/mailman/listinfo/I-D-announce to change your 
> subscription settings.
>
>
> Internet-Drafts are also available by anonymous FTP. Login with the 
> username
> "anonymous" and a password of your e-mail address. After logging in,
> type "cd internet-drafts" and then
>     "get draft-ietf-dnsop-key-rollover-requirements-02.txt".
>
> A list of Internet-Drafts directories can be found in
> http://www.ietf.org/shadow.html or 
> ftp://ftp.ietf.org/ietf/1shadow-sites.txt
>
>
> Internet-Drafts can also be obtained by e-mail.
>
> Send a message to:
>     [email-masked].
> In the body type:
>     "FILE 
> /internet-drafts/draft-ietf-dnsop-key-rollover-requirements-02.txt".
>     
> NOTE:    The mail server at ietf.org can return the document in
>     MIME-encoded form by using the "mpack" utility.  To use this
>     feature, insert the command "ENCODING mime" before the "FILE"
>     command.  To decode the response(s), you will need "munpack" or
>     a MIME-compliant mail reader.  Different MIME-compliant mail readers
>     exhibit different behavior, especially when dealing with
>     "multipart" MIME messages (i.e. documents which have been split
>     up into multiple messages), so check your local documentation on
>     how to manipulate these messages.
>        
>        
> Below is the data which will enable a MIME compliant mail reader
> implementation to automatically retrieve the ASCII version of the
> Internet-Draft.
>  
>

-- 
Gilles Guette
IRISA/INRIA Rennes
France

.
dnsop resources:_____________________________________________________
web user interface: http://darkwing.uoregon.edu/~llynch/dnsop.html
mhonarc archive: http://darkwing.uoregon.edu/~llynch/dnsop/index.html

---

From: Miek Gieben <[email-masked]>
Date: Thu, 20 Jan 2005 11:22:03 +0100

[On 20 Jan, @ 09:07, Gilles wrote in "Re: [dnsop] I-D ACTION:draft-i ..."]
> and include a document changes section.

[I've not thoroughly reviewed this draft, just a quick read of the
diff from 01->02]

But I have a question. Where does this draft fit in?
Taking into account that dnssec-operational-practice-03 also deals
with key rollovers.  And that epp-secdns tries to get a handle on what
to send to your parent zone during updates. 

Regards,
Miek
.

---

From: Gilles Guette <[email-masked]>
Date: Fri, 21 Jan 2005 14:25:04 +0100

>to send to your parent zone during updates. 
This draft is a requirement draft, thus the goal is to explicitely 
describe automated key rollover problems.

We think that automated rollover is under treated in operationnal 
practice and some problems must be exposed. For example:
Automated rollover parameters negociation between parent and child
Possible manual changes during an automated rollover
Key rollover process fault tolerance and consistent state of the chain 
of trust.

Or more specifical:
Direct query to authoritative name server avoiding recursive cache server.

Concerning the protocol used to exchange data between parent and child, 
we agree that EPP can indeed be used. But, maybe other people want to 
use another protocol like DNSSEC, IPsec, ...

That is why, we think this draft is enough original and pointed some 
problems not treated in other drafts or RFCs.

Regards

-- 
Gilles Guette
IRISA/INRIA Rennes
France