Subject: RE: WGLC on rollover-requirements and trustudpate-timers

From: "Griffin, Wesley" <[email-masked]>
Date: Tue, 10 Oct 2006 15:48:19 -0400

[ Moderators note: Post was moderated, either because it was posted by
   a non-subscriber, or because it was over 20K.  
   With the massive amount of spam, it is easy to miss and therefore 
   delete relevant posts by non-subscribers. 
   Please fix your subscription addresses. ]

 > -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Olaf M. Kolkman
> 
> This message starts the working group last call for two documents
> 
>            draft-ietf-dnsext-rollover-requirements-03
>       Requirements related to DNSSEC Trust Anchor Rollover
> 
> 
>              draft-ietf-dnsext-trustupdate-timers-04
>            Automated Updates of DNSSEC Trust Anchors
> 
> The documents and their history can be found at:
> 
> http://tools.ietf.org/wg/dnsext/draft-ietf-dnsext-rollover-req
> uirements/
> http://tools.ietf.org/wg/dnsext/draft-ietf-dnsext-trustupdate-timers/

I have reviewed both of these documents and support both of them
advancing. Here is my evaluation of how timers fills the requirements:

1. Scalability - yes.

2. No IPR - I'm not sure about this one as well.

3. General Applicability - yes.

4. Private Networks - yes.

5. Stale Trust Anchor Detection - yes, but like Scott says, it depends
on how many revoked keys the zone administrator chooses to keep around.

6. Manual Operation - yes. From my interpretation of the requirement,
this applies to the resolver administrator. As such, timers-04 does not
prevent a resolver admin from manually performing a 'rollover' of the
configured trust anchor.

7. Planned and Unplanned Rollovers - yes.

8. Timeliness - yes.

9. High Availability - yes, but again, as long as the zone is reachable.

10. New RR Types - I'm happy with the revoke bit.

11. Maintenance Operations - yes.

12. Recovery from Compromise - yes.

13. Non-degrading Trust - yes.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>