Subject: Re: another's view on zone enum & on-line signing

From: Derek Atkins <[email-masked]>
Date: Wed, 22 Sep 2004 13:21:47 -0400

Paul Vixie <[email-masked]> writes:

>> ...
>> As far as on-line signing as an option, he replied that that was not a big
>> deal for him.  "What's the difference between managing extra zone keys and
>> managing TSIG keys for XFR's?"
>
> word on the street is, online signing isn't allowed in the dnssec-bis spec.
> given that i'd been presenting it as a workaround, i now apologize to all
> for misunderstanding the protocol.  getting online signing of negative
> responses would apparently require the same transition pain as NSECxx, so
> we can stop talking about it separately, and fold it into the NSECxx thread,
> which is blocked on a requirements definition, to which ed's words apply:

Yes, this is exactly why a few of us were trying to hold up the
online signing conversation before the bis drafts were finalized,
because we realized you COULDN'T do online signing in bis.  :(

It sucks royally.

-derek

-- 
       Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory
       Member, MIT Student Information Processing Board  (SIPB)
       URL: http://web.mit.edu/warlord/    PP-ASEL-IA     N1NWH
       [email-masked]                        PGP key available

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Edward Lewis <[email-masked]>
Date: Thu, 23 Sep 2004 10:03:27 +0100

>word on the street is, online signing isn't allowed in the dnssec-bis spec.

I was shocked when I heard this in the hallway.  (So I had to remove 
my Paul Vixie kill-file entry ;) ...)

What about a signed zone that is dynamically updated - doesn't that 
physically require on-line signing?

Historically, on-line signing was distasteful because of the thought 
that the private key would be vulnerable to a host attack.  I think 
of that as a security engineer's issue - I don't think it was ever a 
DNS protocol issue.  In addition, in RFC 2065 we had strength bits - 
we tried for a time to use it to separate on-line keys from off-line 
keys.

I don't recall any discussion to "kill off" on-line signing.
-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                            +1-703-227-9854
ARIN Research Engineer

"I can't go to Miami.  I'm expecting calls from telemarketers." -
Grandpa Simpson.