Subject: MUST vs SHOULD for trust anchor rollover, nameserver side

From: Thierry Moreau <[email-masked]>
Date: Thu, 09 Mar 2006 14:40:19 -0500

Dear all:

The question has been raised as which portions of a Trust Anchor
Key (TAK) management solution should be mandatory to implement. I
restrict my post to the nameserver side.

The short answer is that the automated TAK rollover protocol
elements would be mandatory for the DNS root for each of the
mandatory signature algorithms, and optional for other zones and
optional signature algorithms.

I don't think there is a realistic way to specify that such TAK
rollover is mandatory for islands of trust other than the root
because a normal zone (i.e. having a secure delegation from a
secure parent) might become an island of trust suddenly because
the parent zone turns DNSSEC-oblivious without warning.

Some participants insist that anything mandatory-to-implement
must be absolutely free for *anyone* to implement. They would now
promote the freedom of entry into the alternate DNS root
business.

Regards,

-- 

- Thierry Moreau

CONNOTECH Experts-conseils inc.
9130 Place de Montgolfier
Montreal, Qc
Canada   H2M 2A1

Tel.: (514)385-5691
Fax:  (514)385-5900

web site: http://www.connotech.com
e-mail: [email-masked]

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>