[EMAIL PROTECTED] writes:
> Pre change:
> example.com SIG KEY expire=200107292257 (1 day)
> host.example.com SIG A expire=200108272257 (30 days)
> Post change:
> example.com SIG KEY expire=200107072258 (1 day)
> host.example.com SIG A expire=200108272258 (30 days)
You are, as I said, signing the host record again. You have to sign all
your other records too, never mind the costs of generating and
distributing the new key.
If you change at least one of your records every day---certainly a
reasonable assumption for the big organizations we're talking about---
then you are signing all your records every day. The key change isn't
accomplishing anything.
The bottom line remains the same. Even without renumbering, you are
signing every record every day. If that isn't a problem, then occasional
renumbering certainly isn't a problem. If you have one day warning, you
can renumber for free.
---Dan
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page: http://playground.sun.com/ipng
FTP archive: ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [EMAIL PROTECTED]
--------------------------------------------------------------------