Subject: DNSSEC protocol doc question: pre-conf keys.

From: "Olaf M. Kolkman" <[email-masked]>
Date: Mon, 31 Mar 2003 11:19:54 +0200

I am going through the DNSSEC protocol modifications document (version
01) to get an answer to the following question:

  Is it legal to have a pre-configured key (trusted-key in bind) that
  is not included in the apex KEY RR set but that is used to create a
  signature over that KEY RR set? 

I've carefully read section 2 and section 4 of the document. But may
have been looking at the wrong place for the answer.

Anyhow, the situation seems to be allowed by the following sentence in
section 2:

  "For each private key used to create SIG RRs, there SHOULD be a
   corresponding KEY RR stored at the zone apex"

Given the SHOULD, a resolver should be able with the case of a
KSK which signes ZSKs in the apex Key RR set and that is exclusively
configured in the resolvers configuration and does not live in the
apex Key RR set. 

Is this a proper interpretation? If so I am afraid that there are other
interpretations possible. The issue of how to deal with preconfigured keys
is not spelled out, shouldn't it?

-- Olaf

--------------------------------------------| Olaf M. Kolkman
                                            | www.ripe.net/disi

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Paul Vixie <[email-masked]>
Date: Mon, 31 Mar 2003 14:38:34 +0000

> I could see where a zone would want to have the secure entry point offline.
> The root zone could publish the key somewhere else, to reduce response
> sizes, for example.  Otherwise, it seems a bit self-defeating.

agreed.

> Is there a reason for stating that a zone MUST have its secure entry point
> key in the served zone?

not in my view.  this appears to be an overspecification.