To:
<dnsop@cafax.se>
From:
"Scott Rose" <scottr@antd.nist.gov>
Date:
Mon, 2 Jul 2001 11:44:04 -0400
Sender:
owner-dnsop@cafax.se
Subject:
comments on draft-ietf-dnsop-resolver-rollover-00.txt
First, I think this is a good draft to discuss more of the security maintenance necessary once DNSSEC gets deployed on a larger scale. However, there are two points I would like to bring up to the group for discussion: 1. In section 2.2, the sixth paragraph states that "During a PC-rollover [a delegated child conducts a key rollover] the old and the new key have to coexist in the zone and the zone must be signed with both the old and new keys so that end-users..." Should this "must" be a "MUST"? I think it would stress a key part of this feature, and would be necessary. 2. The draft should stress that this rollover transaction should only be used for scheduled KEY rollover. An emergency rollover (compromised key) would require more timely interaction and some out of band communication for both the PC and SE rollovers. Hard-nosed security folk will be quick to jump on this point. Scott =============================================================== Scott Rose Advanced Network Technologies Division NIST ph: 301-975-8439 fax: 301-590-0932 http://www.nist.gov ===============================================================