Subject: Re: trying to close Editor's Question Q-29

From: [email-masked]
Date: Tue, 10 Feb 2004 16:39:48 +0100 (CET)

On Tue, 10 Feb 2004, Ted Lindgreen wrote:

> [Quoting Miek Gieben, on Feb 10, 16:01, in "Re: trying to close  ..."]
> > [On 10 Feb, @15:39, roy wrote in "Re: trying to close Editor's Q ..."]
> > > I want validation to BREAK when it is way passed/before the
> > ^^^^^
> > making the issue local policy IMHO...
>
> No, that is the local policy at the validator-side, Roy was talking
> about what he wants from the signers perspective.

Exactly.

> While I agree with Roy on "way passed/before" time difference, I
> also agree with the people at the workshop that argued that some
> slack is needed to cope with small clock variations and/or
> network delays.

The delay/variation problem can be solved with overlapping
keys/signatures.

KEY1 : day 5 ... day 10
KEY2 : day 9 ... day 20

This way, there is a one day slack either way. This is the reason
that there is no 'fudge' in the RRSIG record, like the TSIG record has.

Roy

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Jim Reid <[email-masked]>
Date: Tue, 10 Feb 2004 23:45:01 +0000

>>>>> "Ted" == Ted Lindgreen <[email-masked]> writes:

    Ted> While I agree with Roy on "way passed/before" time
    Ted> difference, I also agree with the people at the workshop that
    Ted> argued that some slack is needed to cope with small clock
    Ted> variations and/or network delays.

    Ted> Perhaps we can settle this dispute with an addition like:

    >> > "SHOULD be rejected, but MAY use RRSIGs if other security
    >> > checks were successful, depending on local policy, to
    >> > cope with small clock variations or network delays".

I think a definition of "small" will be needed. How about using the same
fudge factor TSIG allows for skewed clocks?