Subject: RE: ISSUE 5: Embedded requirements, was Re: Pending issues for draft-ietf-dnsext-rollover-requirements-00

From: "Scott Rose" <[email-masked]>
Date: Tue, 11 Apr 2006 12:46:50 -0400

> -----Original Message-----
> From: [email-masked]
> [mailto:[email-masked]]On Behalf Of Suresh Krishnaswamy

I have one question about one of the additions.

>
> ISSUE 5: WG submission has embedded requirements in definitions
>
> STATUS: OPEN
>
> REFERENCE:
>
> http://ops.ietf.org/lists/namedroppers/namedroppers.2006/msg00206.html
> http://ops.ietf.org/lists/namedroppers/namedroppers.2006/msg00228.html
>
> DESCRIPTION:
>
>    Added the following text to the "Timeliness" requirement:
>        Operators of security-aware resolvers using RR(s) from that
>        zone as Trust Anchors need to acquire new and remove revoked
>        Trust Anchors such that no old key is used for long after
>        revocation.
>

I support this requirement in principle, but I am unsure what a "long time
period" would be.  How about the TTL of the DNSKEY RR?  Just thinking out
loud, but when a rollover is seen, the old trust anchor should be purged as
if it were part of the cache at that point.

>    Added the following text to the "Scalability" requirement:
>        The automated Trust Anchor Rollover solution MUST be
>        able to support Trust Anchors for multiple zones and
>        multiple Trust Anchors for each DNS zone.
>

I support this requirement.

Scott

>
> --
> to unsubscribe send a message to [email-masked] with
> the word 'unsubscribe' in a single line as the message text body.
> archive: <http://ops.ietf.org/lists/namedroppers/>

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>