[DNSOP] .PR servfails due to wrong key in DLV

2009-09-08 Thread Paul Wouters
On Tue, 8 Sep 2009, Stephane Bortzmeyer wrote: [added dnsop@ietf.org to the reply] Subject: [Unbound-users] .PR servfails with Unbound but not with BIND % dig SOA pr. I get the key through DLV. It's outdated and wrong and missing the new key. On Aug 19 2009, pr added this key: PR.

Re: [DNSOP] Key Management and Provisioningl was Re: .PR ...

2009-09-08 Thread bmanning
a few of us actually did a little work in this area three or four years ago - did working proof of concepts - and were promptly ignored. (the claim was - this work was premature) --bill On Tue, Sep 08, 2009 at 01:23:51PM -0400, Edward Lewis wrote: At 13:13 -0400 9/8/09, Paul Wouters wrote:

Re: [DNSOP] .PR servfails due to wrong key in DLV

2009-09-08 Thread Stephane Bortzmeyer
On Tue, Sep 08, 2009 at 09:56:58AM -0700, David Conrad d...@virtualized.org wrote a message of 33 lines which said: Out of curiosity (since I'm not on the unbound-users list), why did it work with BIND and not Unbound? Probably a caching effect and not a real difference between the

Re: [DNSOP] Key Management and Provisioningl was Re: .PR ...

2009-09-08 Thread Kim Davies
On 8/09/09 11:52 AM, Chris Thompson c...@cam.ac.uk wrote: ISC supposedly get their data for TLDs from the IANA ITAR. That's certainly up to date now at https://itar.iana.org/anchors/anchors.xml but it would be more than interesting to know how long that has been the case. (As I recall, PR

Re: [DNSOP] Key Management and Provisioningl was Re: .PR ...

2009-09-08 Thread David Conrad
Ed, On Sep 8, 2009, at 12:12 PM, Edward Lewis wrote: So, in order to roll a key, you have to ensure DLV registries have replaced the keys, even when the DLV registries obtain the originals indirectly? Seems a bit broken to me. That's not broken, that's reality. I disagree. Requiring

Re: [DNSOP] Key Management and Provisioningl was Re: .PR ...

2009-09-08 Thread Stephane Bortzmeyer
On Tue, Sep 08, 2009 at 11:23:16AM -0700, David Conrad d...@virtualized.org wrote a message of 21 lines which said: So, in order to roll a key, you have to ensure DLV registries have replaced the keys, even when the DLV registries obtain the originals indirectly? Seems a bit broken to

[DNSOP] provisioning and OTE for the signed root

2009-09-08 Thread Jim Reid
On 8 Sep 2009, at 21:19, Edward Lewis wrote: What would impress me is a proposal to sign the root zone that included a real good look at the provisioning interface as well as an OTE. For instance, promise me a response to a DS change in a matter of hours or minutes, not a day. Ed, what

Re: [DNSOP] Key Management and Provisioningl was Re: .PR ...

2009-09-08 Thread Mark Andrews
In message 68f05a6e-256d-4c61-b03d-82e9e9493...@virtualized.org, David Conrad writes: On Sep 8, 2009, at 10:13 AM, Paul Wouters wrote: I am not sure what appliance or software setup '.pr' uses, but it should have never allowed to finish the key rollover with the bad key in the ISC

Re: [DNSOP] Key Management and Provisioningl was Re: .PR ...

2009-09-08 Thread Mark Andrews
In message c6cc01aa.15a48%kim.dav...@icann.org, Kim Davies writes: On 8/09/09 11:52 AM, Chris Thompson c...@cam.ac.uk wrote: ISC supposedly get their data for TLDs from the IANA ITAR. That's certainly up to date now at https://itar.iana.org/anchors/anchors.xml but it would be more than