Subject: KSK Flag could have a better name

From: David Blacka <[email-masked]>
Date: Wed, 19 Mar 2003 23:06:21 -0500

I've been trying to come up with my reasoning on this issue for a few
days, and this is what I have so far:

There is evidence that the KSK flag causes confusion when it comes to
zone signing.  Specifically, the confusion occurs by trying to use the
KSK flag as an indicator that the key in question is not a ZSK.

The problem seems to be that the very name of the flag, KSK flag,
implies that a zone is using the KSK/ZSK model (i.e., that there are
separate keys for the KSK and ZSK roles).  This may or may not be the
case.

What the flag really means is that the key is intended to be used as
the secure entry point for a zone.  It makes no statement about the
key's status as a zone signing key.

To be fair, the draft seems pretty clear on this issue.  Since a key
that is a secure entry key (that is, it has a corresponding DS in the
zone's parent) pretty much MUST sign the zone apex keyset, it actually
is, in the narrow sense, a Key Signing Key.

My belief is that the confusion here is caused by the fact that the
term "Key Signing Key" or KSK is used so heavily in discussion of a
particular key management technique (i.e., a separate KSK and ZSK)
that the use of the name in the flag implies (rightly or wrongly) that
this technique is in use.

So, I think we need a separate term for this flag and the keys that
use it.  Perhaps "Security Entry Point Key (Flag)", or "Introductory
Key (Flag)".  I might also be a good idea for the KSK flag draft to be
a bit more explict about how a zone signer should and shouldn't use
this flag.

-- 
David Blacka    <[email-masked]> 
Sr. Engineer    Verisign Applied Research

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>