To:
Bill Manning <bmanning@isi.edu>
Cc:
scottr@antd.nist.gov, dnssec@cafax.se
From:
"Olaf M. Kolkman" <olaf@ripe.net>
Date:
Thu, 10 Oct 2002 15:27:11 +0200
In-Reply-To:
<200210101250.g9ACoT721088@boreas.isi.edu>
Sender:
owner-dnssec@cafax.se
Subject:
Re: root zone signing and key lengths/lifetimes
> we are using a key signing key with a validity period of 12 months
> and zone signing keys of 30 days in the testbed.
I hope that the signing validity periods will be made smaller by at
least a factor 3-4.
The signing validity period is an indication for how long a
(compromised) key remains useful. A stronger key may not be
compromised by crypto analysis but may still be compromised.
A key which is not often rolled over can still be used to generate
signatures with short validity interval's.
In the above scheme, if a root zonesigning key, would be compromised
it would be usable for the bad guys for a maximum of 12 months.
If one of the TLD's keys would be compromised that 'situation' could
persist for a maximum of 30 days.
I wonder if 3 months for key and a week for zone signing signature
validity intervals would be feasible for the root.
--Olaf
--------------------------------------------| Olaf M. Kolkman
| www.ripe.net/disi