Subject: Re: DNSEXT WGLC: Key-Signing Key (KSK) Flag

From: Paul Vixie <[email-masked]>
Date: Wed, 19 Mar 2003 00:25:55 +0000

[david blacka]
> I strongly believe that if we are going to define a bit in the KEY RR
> (or any other field in any other RR for that matter), it should have
> an _on_the_wire_ use.  ...

i agree with this, and it's a better way of putting it then i wrote earlier.

but wait, there's a reference:

> How can we control our data quality?
> 
> Ken Orr, (Data Quality and Systems Theory, CACM 41,2) puts forward a
> case that maintaining data quality is a "use based" issue and that, like
> all engineering control systems, this involves a steady stream of
> feedback in this case feedback from the data users. His exploration of
> the subject has led him to deduce certain rules regarding data quality:
> 
>    o Unused Data cannot remain correct for very long.
>    o Data quality if a function of its use, not its collection
>    o Data quality will be no better than its most stringent use
>    o Data quality problems becomes worse as the system ages
>    o If some data element is unlikely to change, when it does
>      change it will be traumatic for the data user
>    o Data quality applies to data AND to metadata.

so, far from removing the KSK bit, i'm in favour of using it in validation,
so that it will be nonoptional, and there will be instant feedback when it
is incorrect.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Olaf Kolkman <[email-masked]>
Date: Fri, 21 Mar 2003 01:14:31 +0100

David Blacka <[email-masked]> writes:

(...)
 * So, I think we need a separate term for this flag and the keys that
 * use it.  Perhaps "Security Entry Point Key (Flag)", or "Introductory
 * Key (Flag)".  I might also be a good idea for the KSK flag draft to be
 * a bit more explict about how a zone signer should and shouldn't use
 * this flag.
(...)

When this bit was first suggested, long time ago, somebody referred to
it as the secure entry point (SEP) bit. While writing the document I
choose to use the wording of the DS draft since I do not like to have
to many definitions of different key-roles around.

I agree with your point and would like to change the wording but it
would be nice if the same wording would be used in the DS draft as
well. So this is a suggestion to Olafur to change his text as well (we
can do synchronization off-line).

--Olaf